Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
fAzUnj6Djg.exe

Overview

General Information

Sample name:fAzUnj6Djg.exe
renamed because original name is a hash value
Original sample name:b8025d9ec1c56eef774e90a448c30efbeea547ff60cee57169680d832b76b7f4.exe
Analysis ID:1549344
MD5:51956d90e55c86ee8fa57a5f26625454
SHA1:be35dbe23ebfaa91d825bc161538e130c0886276
SHA256:b8025d9ec1c56eef774e90a448c30efbeea547ff60cee57169680d832b76b7f4
Tags:exeHawkEyeuser-adrian__luca
Infos:

Detection

HawkEye, MailPassView
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected HawkEye Rat
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected HawkEye Keylogger
Yara detected MailPassView
.NET source code contains potential unpacker
.NET source code contains process injector
.NET source code references suspicious native API functions
AI detected suspicious sample
Allocates memory in foreign processes
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to detect sleep reduction / modifications
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Sample uses process hollowing technique
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected WebBrowserPassView password recovery tool
Abnormal high CPU Usage
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May infect USB drives
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious Outbound SMTP Connections
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara signature match

Classification

  • System is w10x64
  • fAzUnj6Djg.exe (PID: 6684 cmdline: "C:\Users\user\Desktop\fAzUnj6Djg.exe" MD5: 51956D90E55C86EE8FA57A5F26625454)
    • RegSvcs.exe (PID: 6848 cmdline: "C:\Users\user\Desktop\fAzUnj6Djg.exe" MD5: 3A77A4F220612FA55118FB8D7DDAE83C)
      • vbc.exe (PID: 1344 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holdermail.txt" MD5: D881DE17AA8F2E2C08CBB7B265F928F9)
      • vbc.exe (PID: 6340 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holderwb.txt" MD5: D881DE17AA8F2E2C08CBB7B265F928F9)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
HawkEye Keylogger, HawkEye, HawkEye RebornHawKeye is a keylogger that is distributed since 2013. Discovered by IBM X-Force, it is currently spread over phishing campaigns targeting businesses on a worldwide scale. It is designed to steal credentials from numerous applications but, in the last observed versions, new "loader capabilities" have been spotted. It is sold by its development team on dark web markets and hacking forums.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.hawkeye_keylogger
No configs have been found
SourceRuleDescriptionAuthorStrings
00000003.00000002.1773170943.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
    00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
      00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
        00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
          00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
            Click to see the 21 entries
            SourceRuleDescriptionAuthorStrings
            3.2.vbc.exe.400000.0.raw.unpackJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
              1.2.RegSvcs.exe.3838e10.6.unpackJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
                1.2.RegSvcs.exe.61fa72.1.unpackJoeSecurity_MailPassViewYara detected MailPassViewJoe Security
                  1.2.RegSvcs.exe.5c9c0d.2.unpackJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
                    4.2.vbc.exe.400000.0.raw.unpackJoeSecurity_WebBrowserPassViewYara detected WebBrowserPassView password recovery toolJoe Security
                      Click to see the 63 entries

                      System Summary

                      barindex
                      Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 192.185.159.182, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe, Initiated: true, ProcessId: 6848, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 60911
                      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                      2024-11-05T15:10:39.509727+010020229301A Network Trojan was detected52.149.20.212443192.168.2.460912TCP
                      2024-11-05T15:11:09.063613+010020229301A Network Trojan was detected52.149.20.212443192.168.2.457072TCP
                      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                      2024-11-05T15:10:25.325813+010028107032Device Retrieving External IP Address Detected192.168.2.449733104.19.223.7980TCP
                      2024-11-05T15:10:26.100861+010028107032Device Retrieving External IP Address Detected192.168.2.449734104.19.223.79443TCP

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Source: fAzUnj6Djg.exeAvira: detected
                      Source: fAzUnj6Djg.exeReversingLabs: Detection: 65%
                      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                      Source: fAzUnj6Djg.exeJoe Sandbox ML: detected
                      Source: fAzUnj6Djg.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                      Source: unknownHTTPS traffic detected: 104.19.223.79:443 -> 192.168.2.4:49734 version: TLS 1.0
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior
                      Source: Binary string: wntdll.pdbUGP source: fAzUnj6Djg.exe, 00000000.00000003.1709483597.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, fAzUnj6Djg.exe, 00000000.00000003.1710828281.0000000004A00000.00000004.00001000.00020000.00000000.sdmp
                      Source: Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4167686139.00000000079E0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp
                      Source: Binary string: wntdll.pdb source: fAzUnj6Djg.exe, 00000000.00000003.1709483597.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, fAzUnj6Djg.exe, 00000000.00000003.1710828281.0000000004A00000.00000004.00001000.00020000.00000000.sdmp
                      Source: Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000003.00000002.1773170943.0000000000400000.00000040.00000400.00020000.00000000.sdmp
                      Source: Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmp
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: autorun.inf
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: [autorun]
                      Source: RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: autorun.inf
                      Source: RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmpBinary or memory string: [autorun]
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,3_2_00406EC3
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,4_2_00408441
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,4_2_00407E0E
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A558A6
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then jmp 04A51A73h1_2_04A519A0
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then jmp 04A51A73h1_2_04A519B0
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then call 04A51B20h1_2_04A57E93
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A57E93
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A58993
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then call 04A51B20h1_2_04A585E4
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A585E4
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A59AE9
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A517F8
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A514C0
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then call 04A51B20h1_2_04A586CE
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A586CE
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then mov esp, ebp1_2_04A549C8
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A58CD9
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A50728
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A56039
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A56711
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A59466
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A5937C
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 4x nop then lea esp, dword ptr [ebp-0Ch]1_2_04A59C7F

                      Networking

                      barindex
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.28604a8.5.raw.unpack, type: UNPACKEDPE
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive
                      Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
                      Source: unknownDNS query: name: whatismyipaddress.com
                      Source: unknownDNS query: name: whatismyipaddress.com
                      Source: unknownDNS query: name: whatismyipaddress.com
                      Source: Network trafficSuricata IDS: 2810703 - Severity 2 - ETPRO MALWARE MSIL/Golroted.B or HawkEye External IP Check with minimal headers : 192.168.2.4:49733 -> 104.19.223.79:80
                      Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:60912
                      Source: Network trafficSuricata IDS: 2810703 - Severity 2 - ETPRO MALWARE MSIL/Golroted.B or HawkEye External IP Check with minimal headers : 192.168.2.4:49734 -> 104.19.223.79:443
                      Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:57072
                      Source: unknownHTTPS traffic detected: 104.19.223.79:443 -> 192.168.2.4:49734 version: TLS 1.0
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownTCP traffic detected without corresponding DNS query: 192.185.159.182
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comConnection: Keep-Alive
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: @nss3.dllSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe%programfiles%\Sea MonkeySOFTWARE\Mozillamozilla%s\binPathToExe%programfiles%\Mozilla FirefoxSELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins.---signons.txtsignons2.txtsignons3.txtsignons.sqlitenetmsg.dllUnknown Error\Error %d: %seditkernel32.dll... open %2.2X %s (%s)Microsoft_WinInetMicrosoft_WinInet_u7@dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
                      Source: vbc.exe, 00000004.00000002.1788187036.000000000060B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: `s://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/loginr equals www.facebook.com (Facebook)
                      Source: vbc.exe, 00000004.00000002.1788187036.000000000060B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: `s://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/loginr equals www.yahoo.com (Yahoo)
                      Source: vbc.exeString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
                      Source: global trafficDNS traffic detected: DNS query: 234.77.3.0.in-addr.arpa
                      Source: global trafficDNS traffic detected: DNS query: whatismyipaddress.com
                      Source: global trafficDNS traffic detected: DNS query: mail.hammer-adv.net
                      Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 05 Nov 2024 14:10:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffcf-mitigated: challenge
                      Source: bhv61A5.tmp.4.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
                      Source: bhv61A5.tmp.4.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
                      Source: bhv61A5.tmp.4.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
                      Source: bhv61A5.tmp.4.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
                      Source: bhv61A5.tmp.4.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                      Source: bhv61A5.tmp.4.drString found in binary or memory: http://ocsp.digicert.com0
                      Source: RegSvcs.exe, 00000001.00000002.4166661108.0000000006699000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166661108.0000000006650000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://r11.i.lencr.org/0
                      Source: RegSvcs.exe, 00000001.00000002.4166661108.0000000006699000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166661108.0000000006650000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://r11.o.lencr.org0#
                      Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://whatismyipaddress.com
                      Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://whatismyipaddress.com/
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://whatismyipaddress.com/-
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: RegSvcs.exe, 00000001.00000002.4165739878.0000000004F70000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm9
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://www.nirsoft.net/
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.site.com/logs.php
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: RegSvcs.exe, 00000001.00000002.4166661108.0000000006699000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
                      Source: RegSvcs.exe, 00000001.00000002.4166661108.0000000006699000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
                      Source: vbc.exe, 00000004.00000002.1788630707.00000000006E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728
                      Source: vbc.exe, 00000004.00000002.1788630707.00000000006E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                      Source: vbc.exe, 00000004.00000002.1788630707.00000000006E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                      Source: vbc.exe, 00000004.00000002.1788187036.000000000060B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.liv
                      Source: vbc.exe, 00000004.00000002.1788630707.00000000006E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                      Source: vbc.exe, 00000004.00000002.1788630707.00000000006E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=0000000048072BS
                      Source: vbc.exeString found in binary or memory: https://login.yahoo.com/config/login
                      Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://whatismyipaddress.com
                      Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://whatismyipaddress.com/
                      Source: vbc.exeString found in binary or memory: https://www.google.com/accounts/servicelogin
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734

                      Key, Mouse, Clipboard, Microphone and Screen Capturing

                      barindex
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.28604a8.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: fAzUnj6Djg.exe PID: 6684, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 6848, type: MEMORYSTR
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, Form1.cs.Net Code: HookKeyboard
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_00406069 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,3_2_00406069
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_00405FC6 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,3_2_00405FC6
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_004072FB EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,4_2_004072FB
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00407363 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,4_2_00407363
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E

                      System Summary

                      barindex
                      Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPEMatched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPEMatched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: 1.2.RegSvcs.exe.28604a8.5.raw.unpack, type: UNPACKEDPEMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects HawkEye RAT Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: HawkEye Author: Kevin Breen <kevin@techanarchy.net>
                      Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect HawkEye in memory Author: JPCERT/CC Incident Response Group
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess Stats: CPU usage > 49%
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04AD666E NtWriteVirtualMemory,1_2_04AD666E
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04AD65C6 NtResumeThread,1_2_04AD65C6
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04AD67DA NtQuerySystemInformation,1_2_04AD67DA
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04AD6641 NtWriteVirtualMemory,1_2_04AD6641
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04AD67A7 NtQuerySystemInformation,1_2_04AD67A7
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,4_2_00408836
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00409A400_2_00409A40
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004120380_2_00412038
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0047E1FA0_2_0047E1FA
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0041A46B0_2_0041A46B
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0041240C0_2_0041240C
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004045E00_2_004045E0
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004128180_2_00412818
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0047CBF00_2_0047CBF0
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0044EBBC0_2_0044EBBC
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00412C380_2_00412C38
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0044ED9A0_2_0044ED9A
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00424F700_2_00424F70
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0041AF0D0_2_0041AF0D
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004271610_2_00427161
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004212BE0_2_004212BE
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004433900_2_00443390
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004433910_2_00443391
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0041D7500_2_0041D750
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004037E00_2_004037E0
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004278590_2_00427859
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0040F8900_2_0040F890
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0042397B0_2_0042397B
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00411B630_2_00411B63
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00423EBF0_2_00423EBF
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_04369B780_2_04369B78
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_00BB761B1_2_00BB761B
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04A51DA81_2_04A51DA8
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04A597901_2_04A59790
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04A55C201_2_04A55C20
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04A560481_2_04A56048
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04A570881_2_04A57088
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04A57E931_2_04A57E93
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04A570981_2_04A57098
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04A51D981_2_04A51D98
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04A55C101_2_04A55C10
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04A57EA01_2_04A57EA0
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_00404DDB3_2_00404DDB
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_0040BD8A3_2_0040BD8A
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_00404E4C3_2_00404E4C
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_00404EBD3_2_00404EBD
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_00404F4E3_2_00404F4E
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_004044194_2_00404419
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_004045164_2_00404516
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_004135384_2_00413538
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_004145A14_2_004145A1
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_0040E6394_2_0040E639
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_004337AF4_2_004337AF
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_004399B14_2_004399B1
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_0043DAE74_2_0043DAE7
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00405CF64_2_00405CF6
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00403F854_2_00403F85
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00411F994_2_00411F99
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00413F8E appears 66 times
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00413E2D appears 34 times
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00442A90 appears 36 times
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 004141D6 appears 88 times
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: String function: 00411538 appears 35 times
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: String function: 00445975 appears 65 times
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: String function: 0041171A appears 37 times
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: String function: 0041718C appears 44 times
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: String function: 0040E6D0 appears 35 times
                      Source: fAzUnj6Djg.exe, 00000000.00000003.1709078303.0000000003E23000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs fAzUnj6Djg.exe
                      Source: fAzUnj6Djg.exe, 00000000.00000003.1708629233.00000000046DD000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs fAzUnj6Djg.exe
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCMemoryExecute.dll@ vs fAzUnj6Djg.exe
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameWebBrowserPassView.exeF vs fAzUnj6Djg.exe
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemailpv.exe< vs fAzUnj6Djg.exe
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePhulli.exe0 vs fAzUnj6Djg.exe
                      Source: fAzUnj6Djg.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                      Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                      Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye
                      Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                      Source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye
                      Source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPEMatched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                      Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye
                      Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                      Source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPEMatched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye
                      Source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                      Source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye
                      Source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                      Source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye
                      Source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPEMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                      Source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPEMatched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye
                      Source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 1.2.RegSvcs.exe.28604a8.5.raw.unpack, type: UNPACKEDPEMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                      Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye
                      Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: RAT_HawkEye date = 01.06.2015, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, description = Detects HawkEye RAT, reference = http://malwareconfig.com/stats/HawkEye
                      Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: HawkEye date = 2015/06, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = KeyLogger, ref = http://malwareconfig.com/stats/HawkEye
                      Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Hawkeye author = JPCERT/CC Incident Response Group, description = detect HawkEye in memory, rule_usage = memory scan, reference = internal research
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, Form1.csCryptographic APIs: 'TransformFinalBlock'
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, Form1.csCryptographic APIs: 'TransformFinalBlock'
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, Form1.csCryptographic APIs: 'TransformFinalBlock'
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, Form1.csBase64 encoded string: 'w52OQ+nOJhKGGc7CGmCaGboI49KcZhDXVIhtVj/HSpIoz62GTUVKq6KWCBp6idXs', 'PN4TW3peZ3UeXi7asDB56E4dMEf6JrdkxXNUlrUjLlWcjHK1wZ5CpLZZKB/ocuFWy9Kw0Q8tIc1Qv7OEgqzD+w=='
                      Source: classification engineClassification label: mal100.phis.troj.spyw.evad.winEXE@7/5@3/2
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04AD404A AdjustTokenPrivileges,1_2_04AD404A
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04AD4013 AdjustTokenPrivileges,1_2_04AD4013
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,0_2_0043701F
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFile created: C:\Users\user\AppData\Roaming\pid.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMutant created: NULL
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeFile created: C:\Users\user\AppData\Local\Temp\corynteriaJump to behavior
                      Source: fAzUnj6Djg.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSystem information queried: HandleInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
                      Source: vbc.exe, 00000004.00000002.1788911203.00000000020A4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
                      Source: fAzUnj6Djg.exeReversingLabs: Detection: 65%
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeFile read: C:\Users\user\Desktop\fAzUnj6Djg.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\fAzUnj6Djg.exe "C:\Users\user\Desktop\fAzUnj6Djg.exe"
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe "C:\Users\user\Desktop\fAzUnj6Djg.exe"
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holdermail.txt"
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holderwb.txt"
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe "C:\Users\user\Desktop\fAzUnj6Djg.exe"Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holdermail.txt"Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holderwb.txt"Jump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeSection loaded: wsock32.dllJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeSection loaded: version.dllJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeSection loaded: mpr.dllJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: pstorec.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: msasn1.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: wininet.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: iertutil.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: cryptsp.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: rsaenh.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: cryptbase.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: pstorec.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: vaultcli.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeSection loaded: wintypes.dllJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
                      Source: fAzUnj6Djg.exeStatic file information: File size 1750363 > 1048576
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dllJump to behavior
                      Source: Binary string: wntdll.pdbUGP source: fAzUnj6Djg.exe, 00000000.00000003.1709483597.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, fAzUnj6Djg.exe, 00000000.00000003.1710828281.0000000004A00000.00000004.00001000.00020000.00000000.sdmp
                      Source: Binary string: C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4167686139.00000000079E0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp
                      Source: Binary string: wntdll.pdb source: fAzUnj6Djg.exe, 00000000.00000003.1709483597.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, fAzUnj6Djg.exe, 00000000.00000003.1710828281.0000000004A00000.00000004.00001000.00020000.00000000.sdmp
                      Source: Binary string: f:\Projects\VS2005\mailpv\Release\mailpv.pdb source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000003.00000002.1773170943.0000000000400000.00000040.00000400.00020000.00000000.sdmp
                      Source: Binary string: f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmp

                      Data Obfuscation

                      barindex
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, Form1.cs.Net Code: IsDotNet System.Reflection.Assembly.Load(byte[])
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, Form1.cs.Net Code: run System.Reflection.Assembly.Load(byte[])
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
                      Source: fAzUnj6Djg.exeStatic PE information: real checksum: 0xa2135 should be: 0x1b3181
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_00BB7FE0 push eax; ret 1_2_00BB7FE5
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_00411879 push ecx; ret 3_2_00411889
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_004118A0 push eax; ret 3_2_004118B4
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_004118A0 push eax; ret 3_2_004118DC
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00442871 push ecx; ret 4_2_00442881
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00442A90 push eax; ret 4_2_00442AA4
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00442A90 push eax; ret 4_2_00442ACC
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00446E54 push eax; ret 4_2_00446E61

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced HiddenJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_0040F64B memset,strcpy,memset,strcpy,strcat,strcpy,strcat,GetModuleHandleA,LoadLibraryExA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,3_2_0040F64B
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion

                      barindex
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004440780_2_00444078
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeAPI/Special instruction interceptor: Address: 436979C
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,4_2_00408836
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 180000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWindow / User API: threadDelayed 4730Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWindow / User API: threadDelayed 4770Jump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeAPI coverage: 3.2 %
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 3_2_00406EC3 FindFirstFileA,FindNextFileA,strlen,strlen,3_2_00406EC3
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00408441 FindFirstFileW,FindNextFileW,wcslen,wcslen,4_2_00408441
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00407E0E FindFirstFileW,FindNextFileW,FindClose,4_2_00407E0E
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 120000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 140000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 180000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 100000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 100000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllT
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711513183.00000000009FE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: 4_2_00408836 memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,FreeLibrary,4_2_00408836
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_043683C8 mov eax, dword ptr fs:[00000030h]0_2_043683C8
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_04369A08 mov eax, dword ptr fs:[00000030h]0_2_04369A08
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_04369A68 mov eax, dword ptr fs:[00000030h]0_2_04369A68
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_00426DA1
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, CMemoryExecute.cs.Net Code: Run contains injection code
                      Source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, CMemoryExecute.cs.Net Code: Run contains injection code
                      Source: 1.2.RegSvcs.exe.2882864.4.raw.unpack, CMemoryExecute.cs.Net Code: Run contains injection code
                      Source: 1.2.RegSvcs.exe.28604a8.5.raw.unpack, CMemoryExecute.cs.Net Code: Run contains injection code
                      Source: 1.2.RegSvcs.exe.79e0000.8.raw.unpack, CMemoryExecute.cs.Net Code: Run contains injection code
                      Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, CMemoryExecute.csReference to suspicious API methods: VirtualAllocEx((IntPtr)array4[0], intPtr, *(uint*)(ptr2 + 80), 12288u, 64u)
                      Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, CMemoryExecute.csReference to suspicious API methods: NtWriteVirtualMemory((IntPtr)array4[0], intPtr, (IntPtr)ptr5, *(uint*)(ptr2 + 84), IntPtr.Zero)
                      Source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, CMemoryExecute.csReference to suspicious API methods: NtSetContextThread((IntPtr)array4[1], (IntPtr)ptr4)
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, RunPE.csReference to suspicious API methods: ReadProcessMemory(, , ref , 2, ref )
                      Source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, RunPE.csReference to suspicious API methods: WriteProcessMemory(array[0], , data, , ref )
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 protect: page execute and read and writeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 protect: page execute and read and writeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeSection loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe protection: execute and read and writeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeSection unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeSection unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000Jump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 2F5008Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 401000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 412000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 416000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 418000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 401000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 443000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 44F000Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 452000Jump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_00436431
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe "C:\Users\user\Desktop\fAzUnj6Djg.exe"Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holdermail.txt"Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holderwb.txt"Jump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
                      Source: fAzUnj6Djg.exeBinary or memory string: Shell_TrayWnd
                      Source: fAzUnj6Djg.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,0_2_0042039F
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

                      Stealing of Sensitive Information

                      barindex
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.28604a8.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: fAzUnj6Djg.exe PID: 6684, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 6848, type: MEMORYSTR
                      Source: Yara matchFile source: 3.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.3838e10.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.61fa72.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.3838e10.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000003.00000002.1773170943.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: fAzUnj6Djg.exe PID: 6684, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 6848, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: vbc.exe PID: 1344, type: MEMORYSTR
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqliteJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Google\Google Talk\AccountsJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic SaltJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\AccountsJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\ProfilesJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live MailJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, PopPassword3_2_00402D9A
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, SMTPPassword3_2_00402D9A
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeCode function: ESMTPPassword3_2_004033D7
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c9c0d.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.3851030.7.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.3838e10.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.3851030.7.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: fAzUnj6Djg.exe PID: 6684, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 6848, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: vbc.exe PID: 6340, type: MEMORYSTR
                      Source: fAzUnj6Djg.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
                      Source: fAzUnj6Djg.exeBinary or memory string: WIN_XP
                      Source: fAzUnj6Djg.exeBinary or memory string: WIN_XPe
                      Source: fAzUnj6Djg.exeBinary or memory string: WIN_VISTA
                      Source: fAzUnj6Djg.exeBinary or memory string: WIN_7

                      Remote Access Functionality

                      barindex
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: \pidloc.txt!HawkEyeKeylogger
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger | Execution Confirmed |
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger | Stealer Records |
                      Source: fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
                      Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: HawkEyeKeylogger
                      Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: -+l'&HawkEye_Keylogger_Execution_Confirmed_
                      Source: RegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: -+l#"HawkEye_Keylogger_Stealer_Records_
                      Source: RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: \pidloc.txt!HawkEyeKeylogger
                      Source: RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: Installed Firewall: MHawkEye_Keylogger_Execution_Confirmed_.txtUHawkEye Keylogger | Execution Confirmed |
                      Source: RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: ==============================================EHawkEye_Keylogger_Stealer_Records_MHawkEye Keylogger | Stealer Records |
                      Source: RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: .jpegCHawkEye_Keylogger_Keylog_Records_
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c76408.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.61fa72.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c70000.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c70000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c8208.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c0000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.5c9c0d.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3c77e0d.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.fAzUnj6Djg.exe.3ccdc72.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.RegSvcs.exe.28604a8.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: fAzUnj6Djg.exe PID: 6684, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 6848, type: MEMORYSTR
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
                      Source: C:\Users\user\Desktop\fAzUnj6Djg.exeCode function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04AD0E9E bind,1_2_04AD0E9E
                      Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_04AD0E6B bind,1_2_04AD0E6B
                      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                      Gather Victim Identity InformationAcquire Infrastructure2
                      Valid Accounts
                      21
                      Windows Management Instrumentation
                      1
                      DLL Side-Loading
                      1
                      Exploitation for Privilege Escalation
                      11
                      Disable or Modify Tools
                      1
                      OS Credential Dumping
                      2
                      System Time Discovery
                      Remote Services11
                      Archive Collected Data
                      4
                      Ingress Tool Transfer
                      Exfiltration Over Other Network Medium1
                      System Shutdown/Reboot
                      CredentialsDomains1
                      Replication Through Removable Media
                      11
                      Native API
                      2
                      Valid Accounts
                      1
                      DLL Side-Loading
                      11
                      Deobfuscate/Decode Files or Information
                      121
                      Input Capture
                      1
                      Peripheral Device Discovery
                      Remote Desktop Protocol1
                      Data from Local System
                      11
                      Encrypted Channel
                      Exfiltration Over BluetoothNetwork Denial of Service
                      Email AddressesDNS ServerDomain Accounts1
                      Shared Modules
                      Logon Script (Windows)2
                      Valid Accounts
                      31
                      Obfuscated Files or Information
                      2
                      Credentials in Registry
                      1
                      Account Discovery
                      SMB/Windows Admin Shares1
                      Email Collection
                      1
                      Remote Access Software
                      Automated ExfiltrationData Encrypted for Impact
                      Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
                      Access Token Manipulation
                      1
                      Software Packing
                      1
                      Credentials In Files
                      2
                      File and Directory Discovery
                      Distributed Component Object Model121
                      Input Capture
                      3
                      Non-Application Layer Protocol
                      Traffic DuplicationData Destruction
                      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script612
                      Process Injection
                      1
                      DLL Side-Loading
                      LSA Secrets129
                      System Information Discovery
                      SSH2
                      Clipboard Data
                      4
                      Application Layer Protocol
                      Scheduled TransferData Encrypted for Impact
                      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                      Masquerading
                      Cached Domain Credentials251
                      Security Software Discovery
                      VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                      Valid Accounts
                      DCSync21
                      Virtualization/Sandbox Evasion
                      Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                      Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                      Virtualization/Sandbox Evasion
                      Proc Filesystem4
                      Process Discovery
                      Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                      Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt21
                      Access Token Manipulation
                      /etc/passwd and /etc/shadow11
                      Application Window Discovery
                      Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                      IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron612
                      Process Injection
                      Network Sniffing1
                      System Owner/User Discovery
                      Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                      Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
                      Hidden Files and Directories
                      Input Capture1
                      System Network Configuration Discovery
                      Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1549344 Sample: fAzUnj6Djg.exe Startdate: 05/11/2024 Architecture: WINDOWS Score: 100 20 whatismyipaddress.com 2->20 22 mail.hammer-adv.net 2->22 24 234.77.3.0.in-addr.arpa 2->24 30 Malicious sample detected (through community Yara rule) 2->30 32 Antivirus / Scanner detection for submitted sample 2->32 34 Multi AV Scanner detection for submitted file 2->34 36 10 other signatures 2->36 8 fAzUnj6Djg.exe 1 2->8         started        signatures3 process4 signatures5 38 Detected HawkEye Rat 8->38 40 Writes to foreign memory regions 8->40 42 Maps a DLL or memory area into another process 8->42 44 2 other signatures 8->44 11 RegSvcs.exe 15 6 8->11         started        process6 dnsIp7 26 192.185.159.182, 587, 60911 UNIFIEDLAYER-AS-1US United States 11->26 28 whatismyipaddress.com 104.19.223.79, 443, 49733, 49734 CLOUDFLARENETUS United States 11->28 46 Detected HawkEye Rat 11->46 48 Changes the view of files in windows explorer (hidden files and folders) 11->48 50 Writes to foreign memory regions 11->50 52 3 other signatures 11->52 15 vbc.exe 1 11->15         started        18 vbc.exe 14 11->18         started        signatures8 process9 signatures10 54 Tries to steal Mail credentials (via file registry) 15->54 56 Tries to steal Instant Messenger accounts or passwords 15->56 58 Tries to steal Mail credentials (via file / registry access) 15->58 60 Tries to harvest and steal browser information (history, passwords, etc) 18->60

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand
                      SourceDetectionScannerLabelLink
                      fAzUnj6Djg.exe66%ReversingLabsWin32.Trojan.AutoitInject
                      fAzUnj6Djg.exe100%AviraTR/AD.Golroted.aymdd
                      fAzUnj6Djg.exe100%Joe Sandbox ML
                      No Antivirus matches
                      No Antivirus matches
                      No Antivirus matches
                      SourceDetectionScannerLabelLink
                      http://www.galapagosdesign.com/staff/dennis.htm90%Avira URL Cloudsafe
                      http://www.site.com/logs.php0%Avira URL Cloudsafe
                      NameIPActiveMaliciousAntivirus DetectionReputation
                      whatismyipaddress.com
                      104.19.223.79
                      truefalse
                        high
                        mail.hammer-adv.net
                        unknown
                        unknownfalse
                          unknown
                          234.77.3.0.in-addr.arpa
                          unknown
                          unknownfalse
                            unknown
                            NameMaliciousAntivirus DetectionReputation
                            https://whatismyipaddress.com/false
                              high
                              http://whatismyipaddress.com/false
                                high
                                NameSourceMaliciousAntivirus DetectionReputation
                                http://www.galapagosdesign.com/staff/dennis.htm9RegSvcs.exe, 00000001.00000002.4165739878.0000000004F70000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                unknown
                                http://www.apache.org/licenses/LICENSE-2.0RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                  high
                                  http://www.fontbureau.comRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                    high
                                    http://www.fontbureau.com/designersGRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                      high
                                      https://whatismyipaddress.comRegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmpfalse
                                        high
                                        http://www.fontbureau.com/designers/?RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                          high
                                          http://www.founder.com.cn/cn/bTheRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                            high
                                            http://r11.o.lencr.org0#RegSvcs.exe, 00000001.00000002.4166661108.0000000006699000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166661108.0000000006650000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                              high
                                              http://www.fontbureau.com/designers?RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                high
                                                http://www.tiro.comRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  high
                                                  http://whatismyipaddress.comRegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    high
                                                    http://www.fontbureau.com/designersRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      high
                                                      http://www.goodfont.co.krRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        high
                                                        http://r11.i.lencr.org/0RegSvcs.exe, 00000001.00000002.4166661108.0000000006699000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4166661108.0000000006650000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          high
                                                          http://www.carterandcone.comlRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            high
                                                            http://www.sajatypeworks.comRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              high
                                                              http://www.typography.netDRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                high
                                                                http://www.fontbureau.com/designers/cabarga.htmlNRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  high
                                                                  http://www.founder.com.cn/cn/cTheRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    high
                                                                    http://www.galapagosdesign.com/staff/dennis.htmRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      high
                                                                      http://www.founder.com.cn/cnRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        high
                                                                        http://www.fontbureau.com/designers/frere-user.htmlRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          high
                                                                          http://x1.c.lencr.org/0RegSvcs.exe, 00000001.00000002.4166661108.0000000006699000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            high
                                                                            http://x1.i.lencr.org/0RegSvcs.exe, 00000001.00000002.4166661108.0000000006699000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4163456934.0000000002AA0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162535474.00000000006D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              high
                                                                              http://www.jiyu-kobo.co.jp/RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                high
                                                                                http://whatismyipaddress.com/-fAzUnj6Djg.exe, 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                  high
                                                                                  http://www.galapagosdesign.com/DPleaseRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    high
                                                                                    http://www.fontbureau.com/designers8RegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      high
                                                                                      https://www.google.com/accounts/serviceloginvbc.exefalse
                                                                                        high
                                                                                        https://login.yahoo.com/config/loginvbc.exefalse
                                                                                          high
                                                                                          http://www.fonts.comRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            high
                                                                                            http://www.sandoll.co.krRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              high
                                                                                              http://www.site.com/logs.phpRegSvcs.exe, 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              unknown
                                                                                              http://www.urwpp.deDPleaseRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                high
                                                                                                http://www.nirsoft.net/vbc.exe, vbc.exe, 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                                                  high
                                                                                                  http://www.zhongyicts.com.cnRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    high
                                                                                                    http://www.sakkal.comRegSvcs.exe, 00000001.00000002.4166030437.0000000006172000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      high
                                                                                                      • No. of IPs < 25%
                                                                                                      • 25% < No. of IPs < 50%
                                                                                                      • 50% < No. of IPs < 75%
                                                                                                      • 75% < No. of IPs
                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                      104.19.223.79
                                                                                                      whatismyipaddress.comUnited States
                                                                                                      13335CLOUDFLARENETUSfalse
                                                                                                      192.185.159.182
                                                                                                      unknownUnited States
                                                                                                      46606UNIFIEDLAYER-AS-1USfalse
                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                      Analysis ID:1549344
                                                                                                      Start date and time:2024-11-05 15:09:28 +01:00
                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                      Overall analysis duration:0h 8m 48s
                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                      Report type:full
                                                                                                      Cookbook file name:default.jbs
                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                      Number of analysed new started processes analysed:9
                                                                                                      Number of new started drivers analysed:0
                                                                                                      Number of existing processes analysed:0
                                                                                                      Number of existing drivers analysed:0
                                                                                                      Number of injected processes analysed:0
                                                                                                      Technologies:
                                                                                                      • HCA enabled
                                                                                                      • EGA enabled
                                                                                                      • AMSI enabled
                                                                                                      Analysis Mode:default
                                                                                                      Analysis stop reason:Timeout
                                                                                                      Sample name:fAzUnj6Djg.exe
                                                                                                      renamed because original name is a hash value
                                                                                                      Original Sample Name:b8025d9ec1c56eef774e90a448c30efbeea547ff60cee57169680d832b76b7f4.exe
                                                                                                      Detection:MAL
                                                                                                      Classification:mal100.phis.troj.spyw.evad.winEXE@7/5@3/2
                                                                                                      EGA Information:
                                                                                                      • Successful, ratio: 100%
                                                                                                      HCA Information:
                                                                                                      • Successful, ratio: 100%
                                                                                                      • Number of executed functions: 41
                                                                                                      • Number of non-executed functions: 315
                                                                                                      Cookbook Comments:
                                                                                                      • Found application associated with file extension: .exe
                                                                                                      • Override analysis time to 240000 for current running targets taking high CPU consumption
                                                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                      • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                      • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                      • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                      • VT rate limit hit for: fAzUnj6Djg.exe
                                                                                                      TimeTypeDescription
                                                                                                      09:10:25API Interceptor7389112x Sleep call for process: RegSvcs.exe modified
                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                      104.19.223.79HqvlYZC7Gf.exeGet hashmaliciousUnknownBrowse
                                                                                                      • whatismyipaddress.com/
                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                      whatismyipaddress.comfile.exeGet hashmaliciousHawkEye, MailPassView, PureLog StealerBrowse
                                                                                                      • 104.19.222.79
                                                                                                      HqvlYZC7Gf.exeGet hashmaliciousUnknownBrowse
                                                                                                      • 104.19.223.79
                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                      UNIFIEDLAYER-AS-1USIPx5gzPi7I.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 162.241.62.63
                                                                                                      1q4pQ8ms4w.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                      • 192.185.118.238
                                                                                                      RDF987656789000.cmd.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                      • 162.241.62.63
                                                                                                      SECRFQ2024-0627 - ON HAND PROJECT - NEOM PROJECTS - SAUDI ELAF Co..exeGet hashmaliciousFormBookBrowse
                                                                                                      • 162.240.81.18
                                                                                                      arm7.elfGet hashmaliciousMirai, GafgytBrowse
                                                                                                      • 50.87.34.4
                                                                                                      Shipping documents.bat.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                      • 192.185.13.234
                                                                                                      De_posit Confirmati0n_ Mitie.htmlGet hashmaliciousUnknownBrowse
                                                                                                      • 69.49.245.172
                                                                                                      https://t.ly/J2OmuGet hashmaliciousHTMLPhisher, Mamba2FABrowse
                                                                                                      • 192.254.233.233
                                                                                                      mpsl.elfGet hashmaliciousMiraiBrowse
                                                                                                      • 142.7.172.86
                                                                                                      mips.elfGet hashmaliciousMiraiBrowse
                                                                                                      • 108.167.167.68
                                                                                                      CLOUDFLARENETUSffsBbRe8UN.exeGet hashmaliciousFormBookBrowse
                                                                                                      • 188.114.96.3
                                                                                                      Quotation.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                      • 172.67.74.152
                                                                                                      09Iz0ja549.exeGet hashmaliciousFormBookBrowse
                                                                                                      • 188.114.96.3
                                                                                                      RFQABCO004806L____________________pdf.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                      • 188.114.97.3
                                                                                                      file.exeGet hashmaliciousPureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, XWormBrowse
                                                                                                      • 104.21.5.155
                                                                                                      En88bvC0fc.exeGet hashmaliciousFormBookBrowse
                                                                                                      • 172.67.153.83
                                                                                                      Employee bonus and payroll 74ae5652.pdfGet hashmaliciousHTMLPhisher, Mamba2FABrowse
                                                                                                      • 188.114.96.3
                                                                                                      nCYUA8nqsg.exeGet hashmaliciousFormBookBrowse
                                                                                                      • 188.114.96.3
                                                                                                      mBms4I508x.exeGet hashmaliciousFormBookBrowse
                                                                                                      • 104.21.15.203
                                                                                                      POP (2).pdfGet hashmaliciousUnknownBrowse
                                                                                                      • 162.159.61.3
                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                      54328bd36c14bd82ddaa0c04b25ed9adRFQABCO004806L____________________pdf.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                      • 104.19.223.79
                                                                                                      arXmRvScc2.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                      • 104.19.223.79
                                                                                                      rHJM63U0Nt.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                      • 104.19.223.79
                                                                                                      Scan- 00399905 Payment slip.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                      • 104.19.223.79
                                                                                                      1q4pQ8ms4w.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                      • 104.19.223.79
                                                                                                      dZJo0ZAVUx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                      • 104.19.223.79
                                                                                                      TEKJ09876545678002.cmd.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                      • 104.19.223.79
                                                                                                      Detalles de la factura_________________________pdf.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                      • 104.19.223.79
                                                                                                      EL GINER.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                      • 104.19.223.79
                                                                                                      PO_63738373663838____________________________________________________________________________.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                      • 104.19.223.79
                                                                                                      No context
                                                                                                      Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                      File Type:Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
                                                                                                      Category:dropped
                                                                                                      Size (bytes):15728640
                                                                                                      Entropy (8bit):0.10805027086476268
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
                                                                                                      MD5:9F6FBA8CABF6D4ECDD5B285F375D352B
                                                                                                      SHA1:ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
                                                                                                      SHA-256:4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
                                                                                                      SHA-512:75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
                                                                                                      Malicious:false
                                                                                                      Reputation:moderate, very likely benign file
                                                                                                      Preview:n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................
                                                                                                      Process:C:\Users\user\Desktop\fAzUnj6Djg.exe
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):532992
                                                                                                      Entropy (8bit):7.513188015413798
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:12288:s1V6IF+4o3okRHOUt1kBo/wA/KN1sXfvSm7zZqvZlw8LeLbJt5FkD7X:sf6Ibo3lFO/yCyCmfSlwPbJtkD7
                                                                                                      MD5:18899E84F4F28910B78B52F6D7F71975
                                                                                                      SHA1:4FE97C0731E7D4E5EE2F53E1D6C65B7D0AC661A6
                                                                                                      SHA-256:C05F1798DEB16891A87DC9E327CF931969FA11D1719E269E4031FA6AD3368B18
                                                                                                      SHA-512:95DDDC6B045C20AF129059AD2C30277EFF74FC6C77C629B984B57C4ABE9D5D0C03AC66128ADD7A05CAA3F120CC6CCA94665B888E954A82314255C6C7F748324A
                                                                                                      Malicious:false
                                                                                                      Reputation:low
                                                                                                      Preview:...KZG5PQUKE..XF.MBDCGG7.YG5PUUKEU0XFGMBDCGG7KYG5PUUKEU0XFGM.DCGI(.WG.Y.t.D..y./$1d35(P98*.34;%*!.:#g?7*c.).....=:1.kX=RbGMBDCGGg.YGyQVU..YWXFGMBDCG.7IXL4XUU.BU0lFGMBDC.L?KYg5PUUKEU0.FGmBDCEG7OYG5PUUKAU0XFGMBD.OG7IYG5PUUIE..XFWMBTCGG7[YG%PUUKEU XFGMBDCGG7KeL=P.UKEU.PFG.BDCGG7KYG5PUUKEU0XF'EBHCGG7KYG5PUUKEU0XFGMBDCGG7KYG5PUUKEU0XFGMBDCGG7KYG5PUuKE]0XFGMBDCGG7CyG5.UUKEU0XFGMBj7"?CKYG..RUKeU0X.@MBFCGG7KYG5PUUKEU.XF'c071$G7KYu5PUuCEU.XFG.EDCGG7KYG5PUUK.U0.h5(.+ GG;KYG50]UKGU0XfOMBDCGG7KYG5PU.KE.0XFGMBDCGG7KYG5P%^CEU0XF.MBDAGB7{$@5\.UKFU0XEGMD..GGo._G5PUUKEU0XFGMBDCGG7KYG5PUUKEU0XFGMBDCGG7Kk44PU_.DU0\FmMBDXwC7.YG5QUUZE+1XFC@Kl@GG=KY94PUQ$AU0R8FMB@,BG7A.F&UDPr.U0XPM[<ECGCXOYG?G.FON~w&GGMFC,AG7AUOZWUUAVP!]jnJD.BQ.6X_V3|B+JEU4^8FMB@D(A7KS(=PU_KES'.LGMES.L@&OJ@$Wd.5DU0\@9LBDG(C7KSA.?\UKOUNYFGI<ECGCXOYG??_UKOU0&GGMFFkLG7A*K5P_:FEU:XF.DBMkIG7AY.5PU.KET XFEMMD..G>KYG5KeWKeU0XFGMBDCoH7KSo%PU_K.W0.FoDBDEE(&KYM5P.T[EU2XDG@MDAGG7K.G7F}@KE_0ZnEMBBCEPX]YG?PWB$RU0RFEZ-\CGM7IO(,PU_KE.0.FEeIDCA(:KYAZKUUAEU
                                                                                                      Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with no line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2
                                                                                                      Entropy (8bit):1.0
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3:Qn:Qn
                                                                                                      MD5:F3B25701FE362EC84616A93A45CE9998
                                                                                                      SHA1:D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
                                                                                                      SHA-256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
                                                                                                      SHA-512:98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
                                                                                                      Malicious:false
                                                                                                      Reputation:high, very likely benign file
                                                                                                      Preview:..
                                                                                                      Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4
                                                                                                      Entropy (8bit):1.5
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3:tn:t
                                                                                                      MD5:2751FAE77B24C37382CF6464173D145E
                                                                                                      SHA1:30E936A16BDF7A13E3854E793FAC7B09D4673EEB
                                                                                                      SHA-256:2DC366499884C061264FE624BE1962D6148D937F9CC400BBA175032FE3767DDF
                                                                                                      SHA-512:2A96E35FA0E66098879E117BFEDEB7829451A6B183A458022473E897E263D2F9EAEAB31BC9DBD11D43610D4459484067EA9F1557EAF0E25A838E75F23576B746
                                                                                                      Malicious:false
                                                                                                      Reputation:low
                                                                                                      Preview:6848
                                                                                                      Process:C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):57
                                                                                                      Entropy (8bit):4.795707286467131
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3:oMty8WbSX/MNn:oMLWus
                                                                                                      MD5:D685103573539B7E9FDBF5F1D7DD96CE
                                                                                                      SHA1:4B2FE6B5C0B37954B314FCAEE1F12237A9B02D07
                                                                                                      SHA-256:D78BC23B0CA3EDDF52D56AB85CDC30A71B3756569CB32AA2F6C28DBC23C76E8E
                                                                                                      SHA-512:17769A5944E8929323A34269ABEEF0861D5C6799B0A27F5545FBFADC80E5AB684A471AD6F6A7FC623002385154EA89DE94013051E09120AB94362E542AB0F1DD
                                                                                                      Malicious:false
                                                                                                      Reputation:moderate, very likely benign file
                                                                                                      Preview:C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                      Entropy (8bit):7.68337669512106
                                                                                                      TrID:
                                                                                                      • Win32 Executable (generic) a (10002005/4) 95.11%
                                                                                                      • AutoIt3 compiled script executable (510682/80) 4.86%
                                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                      • DOS Executable Generic (2002/1) 0.02%
                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                      File name:fAzUnj6Djg.exe
                                                                                                      File size:1'750'363 bytes
                                                                                                      MD5:51956d90e55c86ee8fa57a5f26625454
                                                                                                      SHA1:be35dbe23ebfaa91d825bc161538e130c0886276
                                                                                                      SHA256:b8025d9ec1c56eef774e90a448c30efbeea547ff60cee57169680d832b76b7f4
                                                                                                      SHA512:3ab50406431fe064d35dbcfac796935649d9c0e16d2dde50876988a4c19c7fcb73c709f71b39e9a4c06a11a55b09a008f6fc805a30fb6e80b4842355fb066596
                                                                                                      SSDEEP:24576:ffmMv6Ckr7Mny5QLWsLisUV3+JQQeuLEIJgSn/Eg3q759rxv:f3v+7/5QLWqisQ+JQQeuLTJgxg3q9rxv
                                                                                                      TLSH:D8850212B7D680B6E9A33871297BE327DB3575194323C48BA7E12F778F111509B3A362
                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........
                                                                                                      Icon Hash:1733312925935517
                                                                                                      Entrypoint:0x416310
                                                                                                      Entrypoint Section:.text
                                                                                                      Digitally signed:false
                                                                                                      Imagebase:0x400000
                                                                                                      Subsystem:windows gui
                                                                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                      DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                      Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
                                                                                                      TLS Callbacks:
                                                                                                      CLR (.Net) Version:
                                                                                                      OS Version Major:5
                                                                                                      OS Version Minor:0
                                                                                                      File Version Major:5
                                                                                                      File Version Minor:0
                                                                                                      Subsystem Version Major:5
                                                                                                      Subsystem Version Minor:0
                                                                                                      Import Hash:aaaa8913c89c8aa4a5d93f06853894da
                                                                                                      Instruction
                                                                                                      call 00007F4C2CDD2CFCh
                                                                                                      jmp 00007F4C2CDC6ACEh
                                                                                                      int3
                                                                                                      int3
                                                                                                      int3
                                                                                                      int3
                                                                                                      int3
                                                                                                      int3
                                                                                                      push ebp
                                                                                                      mov ebp, esp
                                                                                                      push edi
                                                                                                      push esi
                                                                                                      mov esi, dword ptr [ebp+0Ch]
                                                                                                      mov ecx, dword ptr [ebp+10h]
                                                                                                      mov edi, dword ptr [ebp+08h]
                                                                                                      mov eax, ecx
                                                                                                      mov edx, ecx
                                                                                                      add eax, esi
                                                                                                      cmp edi, esi
                                                                                                      jbe 00007F4C2CDC6C5Ah
                                                                                                      cmp edi, eax
                                                                                                      jc 00007F4C2CDC6DFAh
                                                                                                      cmp ecx, 00000100h
                                                                                                      jc 00007F4C2CDC6C71h
                                                                                                      cmp dword ptr [004A94E0h], 00000000h
                                                                                                      je 00007F4C2CDC6C68h
                                                                                                      push edi
                                                                                                      push esi
                                                                                                      and edi, 0Fh
                                                                                                      and esi, 0Fh
                                                                                                      cmp edi, esi
                                                                                                      pop esi
                                                                                                      pop edi
                                                                                                      jne 00007F4C2CDC6C5Ah
                                                                                                      pop esi
                                                                                                      pop edi
                                                                                                      pop ebp
                                                                                                      jmp 00007F4C2CDC70BAh
                                                                                                      test edi, 00000003h
                                                                                                      jne 00007F4C2CDC6C67h
                                                                                                      shr ecx, 02h
                                                                                                      and edx, 03h
                                                                                                      cmp ecx, 08h
                                                                                                      jc 00007F4C2CDC6C7Ch
                                                                                                      rep movsd
                                                                                                      jmp dword ptr [00416494h+edx*4]
                                                                                                      nop
                                                                                                      mov eax, edi
                                                                                                      mov edx, 00000003h
                                                                                                      sub ecx, 04h
                                                                                                      jc 00007F4C2CDC6C5Eh
                                                                                                      and eax, 03h
                                                                                                      add ecx, eax
                                                                                                      jmp dword ptr [004163A8h+eax*4]
                                                                                                      jmp dword ptr [004164A4h+ecx*4]
                                                                                                      nop
                                                                                                      jmp dword ptr [00416428h+ecx*4]
                                                                                                      nop
                                                                                                      mov eax, E4004163h
                                                                                                      arpl word ptr [ecx+00h], ax
                                                                                                      or byte ptr [ecx+eax*2+00h], ah
                                                                                                      and edx, ecx
                                                                                                      mov al, byte ptr [esi]
                                                                                                      mov byte ptr [edi], al
                                                                                                      mov al, byte ptr [esi+01h]
                                                                                                      mov byte ptr [edi+01h], al
                                                                                                      mov al, byte ptr [esi+02h]
                                                                                                      shr ecx, 02h
                                                                                                      mov byte ptr [edi+02h], al
                                                                                                      add esi, 03h
                                                                                                      add edi, 03h
                                                                                                      cmp ecx, 08h
                                                                                                      jc 00007F4C2CDC6C1Eh
                                                                                                      Programming Language:
                                                                                                      • [ASM] VS2008 SP1 build 30729
                                                                                                      • [ C ] VS2008 SP1 build 30729
                                                                                                      • [C++] VS2008 SP1 build 30729
                                                                                                      • [ C ] VS2005 build 50727
                                                                                                      • [IMP] VS2005 build 50727
                                                                                                      • [ASM] VS2008 build 21022
                                                                                                      • [RES] VS2008 build 21022
                                                                                                      • [LNK] VS2008 SP1 build 30729
                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9298.rsrc
                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                      .text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                      .rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                      .data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                      .rsrc0xab0000x92980x9400f6be76de0ef2c68f397158bf01bdef3eFalse0.4896801097972973data5.530303089784181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                      RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                                      RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                                      RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                                      RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                                                                                                      RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                                                                                                      RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                                                                                                      RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                                                                                                      RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                                                                                                      RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                                                                                                      RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                                                                                                      RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                                                                                                      RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                                                                                                      RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                                                                                                      RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                                                                                                      RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                                                                                                      RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                                                                                                      RT_STRING0xb28380x43adataEnglishGreat Britain0.3733826247689464
                                                                                                      RT_STRING0xb2c780x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                                      RT_STRING0xb32780x65cdataEnglishGreat Britain0.34336609336609336
                                                                                                      RT_STRING0xb38d80x388dataEnglishGreat Britain0.377212389380531
                                                                                                      RT_STRING0xb3c600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                                                                                                      RT_GROUP_ICON0xb3db80x84dataEnglishGreat Britain0.6439393939393939
                                                                                                      RT_GROUP_ICON0xb3e400x14dataEnglishGreat Britain1.15
                                                                                                      RT_GROUP_ICON0xb3e580x14dataEnglishGreat Britain1.25
                                                                                                      RT_GROUP_ICON0xb3e700x14dataEnglishGreat Britain1.25
                                                                                                      RT_VERSION0xb3e880x19cdataEnglishGreat Britain0.5339805825242718
                                                                                                      RT_MANIFEST0xb40280x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581
                                                                                                      DLLImport
                                                                                                      WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
                                                                                                      VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                                                                                                      WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                                      COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                                                                                                      MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                                                                                                      WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                                                                                                      PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                                                                                                      USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                                                                                                      KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
                                                                                                      USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
                                                                                                      GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
                                                                                                      COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                                      ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
                                                                                                      SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                                                      ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
                                                                                                      OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData
                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                      EnglishGreat Britain
                                                                                                      EnglishUnited States
                                                                                                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                      2024-11-05T15:10:25.325813+01002810703ETPRO MALWARE MSIL/Golroted.B or HawkEye External IP Check with minimal headers2192.168.2.449733104.19.223.7980TCP
                                                                                                      2024-11-05T15:10:26.100861+01002810703ETPRO MALWARE MSIL/Golroted.B or HawkEye External IP Check with minimal headers2192.168.2.449734104.19.223.79443TCP
                                                                                                      2024-11-05T15:10:39.509727+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow152.149.20.212443192.168.2.460912TCP
                                                                                                      2024-11-05T15:11:09.063613+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow152.149.20.212443192.168.2.457072TCP
                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                      Nov 5, 2024 15:10:24.645998955 CET4973380192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:24.650863886 CET8049733104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:24.650944948 CET4973380192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:24.651331902 CET4973380192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:24.656210899 CET8049733104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:25.274674892 CET8049733104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:25.287336111 CET49734443192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:25.287414074 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:25.287525892 CET49734443192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:25.297501087 CET49734443192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:25.297535896 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:25.325813055 CET4973380192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:25.911530972 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:25.911614895 CET49734443192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:25.917139053 CET49734443192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:25.917152882 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:25.917530060 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:25.966407061 CET49734443192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:25.968246937 CET49734443192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:26.015331984 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:26.100873947 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:26.100999117 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:26.101027012 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:26.101078987 CET49734443192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:26.101111889 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:26.101169109 CET49734443192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:26.101185083 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:26.101531982 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:26.101568937 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:26.101645947 CET44349734104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:26.101712942 CET49734443192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:26.109805107 CET49734443192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:35.973402023 CET4973380192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:35.978986979 CET8049733104.19.223.79192.168.2.4
                                                                                                      Nov 5, 2024 15:10:35.979078054 CET4973380192.168.2.4104.19.223.79
                                                                                                      Nov 5, 2024 15:10:36.673788071 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:36.679006100 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:36.679081917 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:37.289047003 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:37.289304018 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:37.294447899 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:37.435712099 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:37.435992956 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:37.440888882 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:37.577963114 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:37.578629971 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:37.583583117 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:37.734966993 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:37.734997988 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:37.735012054 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:37.735032082 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:37.735158920 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:37.735158920 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:37.768465042 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:37.773600101 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:37.907788038 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:37.911187887 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:37.917423964 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.051220894 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.051846027 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:38.056965113 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.191648006 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.199034929 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:38.206408024 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.393353939 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.393706083 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:38.398792028 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.532143116 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.559412003 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:38.565360069 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.709933043 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.710242987 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:38.715322971 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.849131107 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.852369070 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:38.852416992 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:38.852468967 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:38.852509022 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:38.852543116 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:38.852543116 CET60911587192.168.2.4192.185.159.182
                                                                                                      Nov 5, 2024 15:10:38.857438087 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.857552052 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:38.994147062 CET58760911192.185.159.182192.168.2.4
                                                                                                      Nov 5, 2024 15:10:39.044663906 CET60911587192.168.2.4192.185.159.182
                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                      Nov 5, 2024 15:10:24.546581984 CET5551253192.168.2.41.1.1.1
                                                                                                      Nov 5, 2024 15:10:24.554749012 CET53555121.1.1.1192.168.2.4
                                                                                                      Nov 5, 2024 15:10:24.632296085 CET6190853192.168.2.41.1.1.1
                                                                                                      Nov 5, 2024 15:10:24.639408112 CET53619081.1.1.1192.168.2.4
                                                                                                      Nov 5, 2024 15:10:35.973345041 CET4920253192.168.2.41.1.1.1
                                                                                                      Nov 5, 2024 15:10:35.980277061 CET53492021.1.1.1192.168.2.4
                                                                                                      Nov 5, 2024 15:11:06.848850012 CET5354193162.159.36.2192.168.2.4
                                                                                                      Nov 5, 2024 15:11:07.517263889 CET53541001.1.1.1192.168.2.4
                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                      Nov 5, 2024 15:10:24.546581984 CET192.168.2.41.1.1.10xaf7eStandard query (0)234.77.3.0.in-addr.arpaPTR (Pointer record)IN (0x0001)false
                                                                                                      Nov 5, 2024 15:10:24.632296085 CET192.168.2.41.1.1.10x10dcStandard query (0)whatismyipaddress.comA (IP address)IN (0x0001)false
                                                                                                      Nov 5, 2024 15:10:35.973345041 CET192.168.2.41.1.1.10xee31Standard query (0)mail.hammer-adv.netA (IP address)IN (0x0001)false
                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                      Nov 5, 2024 15:10:24.554749012 CET1.1.1.1192.168.2.40xaf7eName error (3)234.77.3.0.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false
                                                                                                      Nov 5, 2024 15:10:24.639408112 CET1.1.1.1192.168.2.40x10dcNo error (0)whatismyipaddress.com104.19.223.79A (IP address)IN (0x0001)false
                                                                                                      Nov 5, 2024 15:10:24.639408112 CET1.1.1.1192.168.2.40x10dcNo error (0)whatismyipaddress.com104.19.222.79A (IP address)IN (0x0001)false
                                                                                                      • whatismyipaddress.com
                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                      0192.168.2.449733104.19.223.79806848C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                      TimestampBytes transferredDirectionData
                                                                                                      Nov 5, 2024 15:10:24.651331902 CET71OUTGET / HTTP/1.1
                                                                                                      Host: whatismyipaddress.com
                                                                                                      Connection: Keep-Alive
                                                                                                      Nov 5, 2024 15:10:25.274674892 CET779INHTTP/1.1 301 Moved Permanently
                                                                                                      Date: Tue, 05 Nov 2024 14:10:25 GMT
                                                                                                      Content-Type: text/html
                                                                                                      Content-Length: 167
                                                                                                      Connection: keep-alive
                                                                                                      Cache-Control: max-age=3600
                                                                                                      Expires: Tue, 05 Nov 2024 15:10:25 GMT
                                                                                                      Location: https://whatismyipaddress.com/
                                                                                                      Set-Cookie: __cf_bm=W1ZE.ThUdjul0aDabzxyBcXEQ9ozo8FCVKs5m6x7jHs-1730815825-1.0.1.1-ZVpg2wE99ruEMQcVoFE7Tk.DqGeqIVx1DbqJHvCTiO.CoqomDzyFjFpIO2ue0CgN6Omuw4r5MFOQOCT07o_iUg; path=/; expires=Tue, 05-Nov-24 14:40:25 GMT; domain=.whatismyipaddress.com; HttpOnly
                                                                                                      X-Frame-Options: DENY
                                                                                                      Server: cloudflare
                                                                                                      CF-RAY: 8ddd6d5b594f28b7-DFW
                                                                                                      alt-svc: h3=":443"; ma=86400
                                                                                                      Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                      Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>


                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                      0192.168.2.449734104.19.223.794436848C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                      TimestampBytes transferredDirectionData
                                                                                                      2024-11-05 14:10:25 UTC71OUTGET / HTTP/1.1
                                                                                                      Host: whatismyipaddress.com
                                                                                                      Connection: Keep-Alive
                                                                                                      2024-11-05 14:10:26 UTC1256INHTTP/1.1 403 Forbidden
                                                                                                      Date: Tue, 05 Nov 2024 14:10:26 GMT
                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                      Transfer-Encoding: chunked
                                                                                                      Connection: close
                                                                                                      Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
                                                                                                      Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
                                                                                                      Cross-Origin-Embedder-Policy: require-corp
                                                                                                      Cross-Origin-Opener-Policy: same-origin
                                                                                                      Cross-Origin-Resource-Policy: same-origin
                                                                                                      Origin-Agent-Cluster: ?1
                                                                                                      Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
                                                                                                      Referrer-Policy: same-origin
                                                                                                      X-Content-Options: nosniff
                                                                                                      cf-mitigated: challenge
                                                                                                      2024-11-05 14:10:26 UTC700INData Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 75 32 36 72 33 6a 47 59 48 5a 4a 38 6c 77 49 32 39 4f 4a 68 61 76 71 39 54 39 36 31 45 36 6a 55 71 79 53 55 63 61 62 6c 31 37 4d 41 4e 54 31 63 54 6c 45 46 73 30 30 6f 39 69 32 48 48 43 6b 6c 70 42 74 42 50 4c 30 33 73 4d 36 6c 67 46 59 34 44 47 35 4d 2f 4e 72 79 33 5a 37 6b 6c 66 4d 41 48 74 47 52 34 54 35 68 31 54 75 67 49 48 59 54 55 2f 56 58 44 65 47 5a 61 37 48 64 75 61 4b 52 31 32 39 72 50 38 7a 62 57 38 6e 75 66 2f 69 6d 4c 74 76 76 72 77 3d 3d 24 59 7a 41 67 34 4a 66 51 39 72 53 49 4f 74 48 44 4c 53 48 2b 75 77 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61
                                                                                                      Data Ascii: cf-chl-out: u26r3jGYHZJ8lwI29OJhavq9T961E6jUqySUcabl17MANT1cTlEFs00o9i2HHCklpBtBPL03sM6lgFY4DG5M/Nry3Z7klfMAHtGR4T5h1TugIHYTU/VXDeGZa7HduaKR129rP8zbW8nuf/imLtvvrw==$YzAg4JfQ9rSIOtHDLSH+uw==Cache-Control: private, max-age=0, no-store, no-cache, must-reva
                                                                                                      2024-11-05 14:10:26 UTC1369INData Raw: 31 66 39 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d
                                                                                                      Data Ascii: 1f93<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name=
                                                                                                      2024-11-05 14:10:26 UTC1369INData Raw: 75 4d 7a 67 34 4c 6a 51 77 4e 79 34 7a 4f 44 6b 75 4e 44 41 33 4c 6a 6b 35 4e 43 41 77 49 43 34 31 4f 54 59 74 4c 6a 51 77 4e 79 34 35 4f 44 51 74 4c 6a 4d 35 4e 79 34 7a 4f 53 30 78 4c 6a 41 31 4e 79 34 7a 4f 44 6b 74 4c 6a 59 31 49 44 41 74 4d 53 34 77 4e 54 59 74 4c 6a 4d 34 4f 53 30 75 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 34 70 78 7d 40 6d
                                                                                                      Data Ascii: uMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}@m
                                                                                                      2024-11-05 14:10:26 UTC1369INData Raw: 47 6c 4b 48 68 66 76 4c 4e 6a 2e 47 39 57 52 4b 2e 57 49 6c 59 36 7a 49 4a 79 36 79 56 31 4e 74 5a 70 4d 65 65 79 32 44 37 7a 57 51 76 59 41 7a 75 42 43 4c 4f 31 37 2e 2e 4d 67 6c 32 42 75 33 4c 38 5f 62 51 71 7a 46 68 76 4e 55 59 71 6e 5a 5a 68 56 4c 42 35 56 2e 6e 75 6f 35 4a 52 31 56 30 79 35 6a 68 67 67 70 79 52 51 6f 79 7a 37 35 6f 6e 53 4c 50 71 37 58 36 5f 4e 47 43 59 54 6c 5a 67 33 67 55 77 79 7a 79 72 37 51 6d 53 4c 5a 5a 30 6a 6b 4a 79 66 49 78 64 6d 66 64 63 32 6f 74 57 69 39 4a 44 72 49 51 59 65 34 77 30 6b 51 4d 69 59 58 70 31 55 5a 6e 6c 59 39 35 4a 30 31 77 57 68 30 5a 46 6a 50 44 5a 43 56 72 46 67 46 36 39 49 69 5f 32 6a 76 4a 74 58 73 34 4b 58 44 39 76 63 68 55 72 51 33 66 70 7a 45 71 70 2e 62 77 53 54 32 55 61 78 33 2e 44 52 45 50 58 78
                                                                                                      Data Ascii: GlKHhfvLNj.G9WRK.WIlY6zIJy6yV1NtZpMeey2D7zWQvYAzuBCLO17..Mgl2Bu3L8_bQqzFhvNUYqnZZhVLB5V.nuo5JR1V0y5jhggpyRQoyz75onSLPq7X6_NGCYTlZg3gUwyzyr7QmSLZZ0jkJyfIxdmfdc2otWi9JDrIQYe4w0kQMiYXp1UZnlY95J01wWh0ZFjPDZCVrFgF69Ii_2jvJtXs4KXD9vchUrQ3fpzEqp.bwST2Uax3.DREPXx
                                                                                                      2024-11-05 14:10:26 UTC1369INData Raw: 2e 68 56 44 5a 47 56 46 63 5f 63 36 6b 72 37 65 35 31 74 5f 6e 79 4a 51 4f 44 4b 78 32 31 72 77 62 55 53 6d 6b 6e 30 2e 4a 64 5f 38 67 6d 48 6d 4f 58 43 69 79 58 66 73 6b 74 73 4e 75 46 7a 43 45 68 50 72 33 51 6f 5f 78 75 45 33 39 69 53 56 49 35 4e 63 66 52 45 72 34 53 79 32 70 6c 30 56 59 6b 73 69 39 69 4d 75 74 6e 78 4c 56 5a 78 33 56 5a 50 58 66 4a 6e 33 6e 6f 42 70 4e 71 6c 64 43 41 61 67 41 70 66 7a 58 43 56 45 73 4c 39 31 78 4b 38 61 51 5a 6f 33 41 7a 56 54 42 2e 51 75 69 65 48 74 48 62 73 5f 65 4f 4f 31 65 4f 41 6a 5a 65 79 51 63 62 5a 51 37 6f 5a 4f 74 53 39 6b 61 76 61 4f 79 7a 73 67 6d 6e 78 50 64 32 49 38 65 52 71 6b 4c 74 6f 35 71 6d 78 6a 77 4a 41 32 4b 36 78 63 62 58 6e 59 6b 65 55 73 6d 44 46 4c 63 79 6b 75 67 36 61 31 61 50 4c 45 4f 4f 75
                                                                                                      Data Ascii: .hVDZGVFc_c6kr7e51t_nyJQODKx21rwbUSmkn0.Jd_8gmHmOXCiyXfsktsNuFzCEhPr3Qo_xuE39iSVI5NcfREr4Sy2pl0VYksi9iMutnxLVZx3VZPXfJn3noBpNqldCAagApfzXCVEsL91xK8aQZo3AzVTB.QuieHtHbs_eOO1eOAjZeyQcbZQ7oZOtS9kavaOyzsgmnxPd2I8eRqkLto5qmxjwJA2K6xcbXnYkeUsmDFLcykug6a1aPLEOOu
                                                                                                      2024-11-05 14:10:26 UTC1369INData Raw: 52 75 47 31 52 55 7a 39 54 73 73 31 6d 7a 38 30 31 58 54 33 63 66 77 50 6c 6c 48 59 34 79 56 76 67 32 43 36 6d 79 31 58 68 47 79 52 39 78 33 36 75 68 73 73 58 44 36 50 73 74 77 46 67 69 68 72 75 50 58 4e 63 45 32 5a 30 68 33 35 41 36 65 52 37 6a 62 77 39 45 65 53 58 36 36 73 48 42 38 71 50 6a 30 54 75 6a 70 48 4e 69 4b 4c 61 6f 35 77 37 54 66 39 76 64 4f 57 32 36 64 30 5a 36 68 6e 31 6f 63 46 75 6c 72 67 77 35 42 4d 34 77 66 6a 51 51 4f 73 79 39 7a 30 6b 36 61 39 72 65 51 43 37 6b 65 6c 5f 76 62 4c 55 78 66 37 79 7a 70 7a 53 5a 78 79 36 4e 69 4d 77 46 6c 42 4d 39 32 45 69 41 67 75 34 6e 4f 32 4a 33 76 55 47 69 41 38 71 6a 73 68 50 49 47 6c 4a 6e 4d 69 6a 37 6b 79 74 44 53 4c 5f 4f 7a 63 34 6e 4a 42 66 6f 4a 49 59 76 4a 31 4a 74 6d 63 42 33 4b 50 43 66 4e
                                                                                                      Data Ascii: RuG1RUz9Tss1mz801XT3cfwPllHY4yVvg2C6my1XhGyR9x36uhssXD6PstwFgihruPXNcE2Z0h35A6eR7jbw9EeSX66sHB8qPj0TujpHNiKLao5w7Tf9vdOW26d0Z6hn1ocFulrgw5BM4wfjQQOsy9z0k6a9reQC7kel_vbLUxf7yzpzSZxy6NiMwFlBM92EiAgu4nO2J3vUGiA8qjshPIGlJnMij7kytDSL_Ozc4nJBfoJIYvJ1JtmcB3KPCfN
                                                                                                      2024-11-05 14:10:26 UTC1246INData Raw: 39 32 48 67 46 34 7a 62 53 70 32 5f 43 41 71 39 2e 72 66 35 4d 6f 41 61 56 47 66 59 70 30 69 46 7a 61 61 6d 7a 4e 57 6a 35 5a 56 76 74 5a 62 6d 62 42 52 57 75 37 43 78 6d 71 67 6f 65 64 68 70 54 4d 2e 45 43 51 43 33 74 54 63 30 73 5a 41 44 59 4e 45 4b 75 2e 7a 7a 51 4b 5f 70 6a 67 73 6f 6b 42 31 69 4e 69 65 79 45 4a 67 47 48 4b 31 5f 59 4a 44 73 78 49 5f 6c 75 70 4a 4a 64 58 48 38 76 53 41 79 5a 50 63 48 49 6b 67 53 44 32 31 50 6a 37 4c 6b 57 5f 67 49 4c 7a 70 62 6f 62 5a 68 67 2e 6f 5f 4a 30 36 38 78 49 30 4e 6c 74 5a 33 6f 4b 4b 38 55 4a 6e 37 6a 5a 52 48 62 4a 58 65 4a 49 4b 30 71 36 59 70 31 6d 62 68 47 39 52 71 50 49 67 54 63 36 59 75 37 47 2e 72 5f 44 34 50 67 64 65 78 37 66 75 6b 6a 67 34 69 46 67 57 73 34 6a 4f 7a 65 6b 55 6f 46 39 6c 6b 52 6b 68
                                                                                                      Data Ascii: 92HgF4zbSp2_CAq9.rf5MoAaVGfYp0iFzaamzNWj5ZVvtZbmbBRWu7CxmqgoedhpTM.ECQC3tTc0sZADYNEKu.zzQK_pjgsokB1iNieyEJgGHK1_YJDsxI_lupJJdXH8vSAyZPcHIkgSD21Pj7LkW_gILzpbobZhg.o_J068xI0NltZ3oKK8UJn7jZRHbJXeJIK0q6Yp1mbhG9RqPIgTc6Yu7G.r_D4Pgdex7fukjg4iFgWs4jOzekUoF9lkRkh
                                                                                                      2024-11-05 14:10:26 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                      Data Ascii: 0


                                                                                                      TimestampSource PortDest PortSource IPDest IPCommands
                                                                                                      Nov 5, 2024 15:10:37.289047003 CET58760911192.185.159.182192.168.2.4220-mondeo.websitewelcome.com ESMTP Exim 4.96.2 #2 Tue, 05 Nov 2024 08:10:37 -0600
                                                                                                      220-We do not authorize the use of this system to transport unsolicited,
                                                                                                      220 and/or bulk e-mail.
                                                                                                      Nov 5, 2024 15:10:37.289304018 CET60911587192.168.2.4192.185.159.182EHLO 216554
                                                                                                      Nov 5, 2024 15:10:37.435712099 CET58760911192.185.159.182192.168.2.4250-mondeo.websitewelcome.com Hello 216554 [173.254.250.76]
                                                                                                      250-SIZE 52428800
                                                                                                      250-8BITMIME
                                                                                                      250-PIPELINING
                                                                                                      250-PIPECONNECT
                                                                                                      250-AUTH PLAIN LOGIN
                                                                                                      250-STARTTLS
                                                                                                      250 HELP
                                                                                                      Nov 5, 2024 15:10:37.435992956 CET60911587192.168.2.4192.185.159.182STARTTLS
                                                                                                      Nov 5, 2024 15:10:37.577963114 CET58760911192.185.159.182192.168.2.4220 TLS go ahead

                                                                                                      Click to jump to process

                                                                                                      Click to jump to process

                                                                                                      Click to dive into process behavior distribution

                                                                                                      Click to jump to process

                                                                                                      Target ID:0
                                                                                                      Start time:09:10:19
                                                                                                      Start date:05/11/2024
                                                                                                      Path:C:\Users\user\Desktop\fAzUnj6Djg.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:"C:\Users\user\Desktop\fAzUnj6Djg.exe"
                                                                                                      Imagebase:0x400000
                                                                                                      File size:1'750'363 bytes
                                                                                                      MD5 hash:51956D90E55C86EE8FA57A5F26625454
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                                                                      • Rule: HawkEye, Description: unknown, Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                                                                      • Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000000.00000002.1711774882.0000000003C70000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                      Reputation:low
                                                                                                      Has exited:true

                                                                                                      Target ID:1
                                                                                                      Start time:09:10:21
                                                                                                      Start date:05/11/2024
                                                                                                      Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:"C:\Users\user\Desktop\fAzUnj6Djg.exe"
                                                                                                      Imagebase:0x1f0000
                                                                                                      File size:32'768 bytes
                                                                                                      MD5 hash:3A77A4F220612FA55118FB8D7DDAE83C
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000001.00000002.4164896004.0000000003831000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: RAT_HawkEye, Description: Detects HawkEye RAT, Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                                                                      • Rule: HawkEye, Description: unknown, Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                                                                                                      • Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000001.00000002.4162117361.00000000005C2000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                      • Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: Hawkeye, Description: detect HawkEye in memory, Source: 00000001.00000002.4163456934.0000000002831000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                                      Reputation:moderate
                                                                                                      Has exited:false

                                                                                                      Target ID:3
                                                                                                      Start time:09:10:28
                                                                                                      Start date:05/11/2024
                                                                                                      Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holdermail.txt"
                                                                                                      Imagebase:0x400000
                                                                                                      File size:1'173'928 bytes
                                                                                                      MD5 hash:D881DE17AA8F2E2C08CBB7B265F928F9
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000003.00000002.1773170943.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      Reputation:moderate
                                                                                                      Has exited:true

                                                                                                      Target ID:4
                                                                                                      Start time:09:10:28
                                                                                                      Start date:05/11/2024
                                                                                                      Path:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\user\AppData\Local\Temp\holderwb.txt"
                                                                                                      Imagebase:0x400000
                                                                                                      File size:1'173'928 bytes
                                                                                                      MD5 hash:D881DE17AA8F2E2C08CBB7B265F928F9
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000004.00000002.1786720145.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      Reputation:moderate
                                                                                                      Has exited:true

                                                                                                      Reset < >

                                                                                                        Execution Graph

                                                                                                        Execution Coverage:3.2%
                                                                                                        Dynamic/Decrypted Code Coverage:1.1%
                                                                                                        Signature Coverage:3.3%
                                                                                                        Total number of Nodes:1606
                                                                                                        Total number of Limit Nodes:47
                                                                                                        execution_graph 83149 467046 83150 46705d 83149->83150 83160 467136 83149->83160 83151 4671a0 83150->83151 83152 46710d 83150->83152 83153 467199 83150->83153 83162 46706e 83150->83162 83155 41171a 75 API calls 83151->83155 83156 41171a 75 API calls 83152->83156 83183 40e380 VariantClear ctype 83153->83183 83168 4670f3 _realloc 83155->83168 83156->83168 83157 4670d2 83159 41171a 75 API calls 83157->83159 83158 41171a 75 API calls 83158->83160 83161 4670d8 83159->83161 83181 443466 75 API calls 83161->83181 83167 4670a9 ctype 83162->83167 83169 41171a 83162->83169 83165 4670e8 83182 45efe7 77 API calls ctype 83165->83182 83167->83151 83167->83157 83167->83168 83168->83158 83171 411724 83169->83171 83172 41173e 83171->83172 83176 411740 std::bad_alloc::bad_alloc 83171->83176 83184 4138ba 83171->83184 83202 411afc 6 API calls __decode_pointer 83171->83202 83172->83167 83174 411766 83206 4116fd 67 API calls std::exception::exception 83174->83206 83176->83174 83203 411421 83176->83203 83177 411770 83207 41805b RaiseException 83177->83207 83180 41177e 83181->83165 83182->83168 83183->83151 83185 41396d 83184->83185 83195 4138cc 83184->83195 83215 411afc 6 API calls __decode_pointer 83185->83215 83187 413973 83216 417f23 67 API calls __getptd_noexit 83187->83216 83192 4138dd 83192->83195 83208 418252 67 API calls 2 library calls 83192->83208 83209 4180a7 67 API calls 7 library calls 83192->83209 83210 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 83192->83210 83193 413929 RtlAllocateHeap 83193->83195 83195->83192 83195->83193 83196 413959 83195->83196 83199 41395e 83195->83199 83201 413965 83195->83201 83211 41386b 67 API calls 4 library calls 83195->83211 83212 411afc 6 API calls __decode_pointer 83195->83212 83213 417f23 67 API calls __getptd_noexit 83196->83213 83214 417f23 67 API calls __getptd_noexit 83199->83214 83201->83171 83202->83171 83217 4113e5 83203->83217 83205 41142e 83205->83174 83206->83177 83207->83180 83208->83192 83209->83192 83211->83195 83212->83195 83213->83199 83214->83201 83215->83187 83216->83201 83218 4113f1 __locking 83217->83218 83225 41181b 83218->83225 83224 411412 __locking 83224->83205 83251 418407 83225->83251 83227 4113f6 83228 4112fa 83227->83228 83316 4169e9 TlsGetValue 83228->83316 83231 4169e9 __decode_pointer 6 API calls 83232 41131e 83231->83232 83242 4113a1 83232->83242 83326 4170e7 68 API calls 5 library calls 83232->83326 83234 41133c 83237 411357 83234->83237 83238 411366 83234->83238 83247 411388 83234->83247 83235 41696e __encode_pointer 6 API calls 83236 411396 83235->83236 83239 41696e __encode_pointer 6 API calls 83236->83239 83327 417047 73 API calls _realloc 83237->83327 83241 411360 83238->83241 83238->83242 83239->83242 83241->83238 83244 41137c 83241->83244 83328 417047 73 API calls _realloc 83241->83328 83248 41141b 83242->83248 83329 41696e TlsGetValue 83244->83329 83245 411376 83245->83242 83245->83244 83247->83235 83341 411824 83248->83341 83252 41841c 83251->83252 83253 41842f EnterCriticalSection 83251->83253 83258 418344 83252->83258 83253->83227 83255 418422 83255->83253 83286 4117af 67 API calls 3 library calls 83255->83286 83257 41842e 83257->83253 83259 418350 __locking 83258->83259 83260 418360 83259->83260 83261 418378 83259->83261 83287 418252 67 API calls 2 library calls 83260->83287 83267 418386 __locking 83261->83267 83290 416fb6 83261->83290 83263 418365 83288 4180a7 67 API calls 7 library calls 83263->83288 83267->83255 83268 41836c 83289 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 83268->83289 83269 4183a7 83271 418407 __lock 67 API calls 83269->83271 83270 418398 83296 417f23 67 API calls __getptd_noexit 83270->83296 83274 4183ae 83271->83274 83276 4183e2 83274->83276 83277 4183b6 83274->83277 83279 413a88 ___free_lc_time 67 API calls 83276->83279 83297 4189e6 InitializeCriticalSectionAndSpinCount __locking 83277->83297 83281 4183d3 83279->83281 83280 4183c1 83280->83281 83298 413a88 83280->83298 83312 4183fe LeaveCriticalSection _doexit 83281->83312 83284 4183cd 83311 417f23 67 API calls __getptd_noexit 83284->83311 83286->83257 83287->83263 83288->83268 83292 416fbf 83290->83292 83291 4138ba _malloc 66 API calls 83291->83292 83292->83291 83293 416ff5 83292->83293 83294 416fd6 Sleep 83292->83294 83293->83269 83293->83270 83295 416feb 83294->83295 83295->83292 83295->83293 83296->83267 83297->83280 83300 413a94 __locking 83298->83300 83299 413b0d __locking _realloc 83299->83284 83300->83299 83302 418407 __lock 65 API calls 83300->83302 83310 413ad3 83300->83310 83301 413ae8 RtlFreeHeap 83301->83299 83303 413afa 83301->83303 83307 413aab ___sbh_find_block 83302->83307 83315 417f23 67 API calls __getptd_noexit 83303->83315 83305 413aff GetLastError 83305->83299 83306 413ac5 83314 413ade LeaveCriticalSection _doexit 83306->83314 83307->83306 83313 419f9d __VEC_memcpy VirtualFree VirtualFree HeapFree __shift 83307->83313 83310->83299 83310->83301 83311->83281 83312->83267 83313->83306 83314->83310 83315->83305 83317 416a01 83316->83317 83318 416a22 GetModuleHandleW 83316->83318 83317->83318 83319 416a0b TlsGetValue 83317->83319 83320 416a32 83318->83320 83321 416a3d GetProcAddress 83318->83321 83324 416a16 83319->83324 83339 41177f Sleep GetModuleHandleW 83320->83339 83323 41130e 83321->83323 83323->83231 83324->83318 83324->83323 83325 416a38 83325->83321 83325->83323 83326->83234 83327->83241 83328->83245 83330 4169a7 GetModuleHandleW 83329->83330 83331 416986 83329->83331 83333 4169c2 GetProcAddress 83330->83333 83334 4169b7 83330->83334 83331->83330 83332 416990 TlsGetValue 83331->83332 83337 41699b 83332->83337 83336 41699f 83333->83336 83340 41177f Sleep GetModuleHandleW 83334->83340 83336->83247 83337->83330 83337->83336 83338 4169bd 83338->83333 83338->83336 83339->83325 83340->83338 83344 41832d LeaveCriticalSection 83341->83344 83343 411420 83343->83224 83344->83343 83345 4161c2 83346 4161d3 83345->83346 83380 41aa31 HeapCreate 83346->83380 83349 416212 83382 416e29 GetModuleHandleW 83349->83382 83354 416223 __RTC_Initialize 83416 41b669 83354->83416 83356 416231 83357 41623d GetCommandLineW 83356->83357 83485 4117af 67 API calls 3 library calls 83356->83485 83431 42235f GetEnvironmentStringsW 83357->83431 83360 41623c 83360->83357 83361 41624c 83437 4222b1 GetModuleFileNameW 83361->83437 83363 416256 83364 416261 83363->83364 83486 4117af 67 API calls 3 library calls 83363->83486 83441 422082 83364->83441 83368 416272 83454 41186e 83368->83454 83371 416279 83373 416284 __wwincmdln 83371->83373 83488 4117af 67 API calls 3 library calls 83371->83488 83460 40d7f0 83373->83460 83376 4162b3 83490 411a4b 67 API calls _doexit 83376->83490 83379 4162b8 __locking 83381 416206 83380->83381 83381->83349 83483 41616a 67 API calls 3 library calls 83381->83483 83383 416e44 83382->83383 83384 416e3d 83382->83384 83386 416fac 83383->83386 83387 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 83383->83387 83491 41177f Sleep GetModuleHandleW 83384->83491 83501 416ad5 70 API calls 2 library calls 83386->83501 83388 416e97 TlsAlloc 83387->83388 83392 416218 83388->83392 83393 416ee5 TlsSetValue 83388->83393 83390 416e43 83390->83383 83392->83354 83484 41616a 67 API calls 3 library calls 83392->83484 83393->83392 83394 416ef6 83393->83394 83492 411a69 6 API calls 4 library calls 83394->83492 83396 416efb 83397 41696e __encode_pointer 6 API calls 83396->83397 83398 416f06 83397->83398 83399 41696e __encode_pointer 6 API calls 83398->83399 83400 416f16 83399->83400 83401 41696e __encode_pointer 6 API calls 83400->83401 83402 416f26 83401->83402 83403 41696e __encode_pointer 6 API calls 83402->83403 83404 416f36 83403->83404 83493 41828b InitializeCriticalSectionAndSpinCount __mtinitlocknum 83404->83493 83406 416f43 83406->83386 83407 4169e9 __decode_pointer 6 API calls 83406->83407 83408 416f57 83407->83408 83408->83386 83494 416ffb 83408->83494 83411 4169e9 __decode_pointer 6 API calls 83412 416f8a 83411->83412 83412->83386 83413 416f91 83412->83413 83500 416b12 67 API calls 5 library calls 83413->83500 83415 416f99 GetCurrentThreadId 83415->83392 83520 41718c 83416->83520 83418 41b675 GetStartupInfoA 83419 416ffb __calloc_crt 67 API calls 83418->83419 83426 41b696 83419->83426 83420 41b8b4 __locking 83420->83356 83421 41b831 GetStdHandle 83425 41b7fb 83421->83425 83422 41b896 SetHandleCount 83422->83420 83423 416ffb __calloc_crt 67 API calls 83423->83426 83424 41b843 GetFileType 83424->83425 83425->83420 83425->83421 83425->83422 83425->83424 83522 4189e6 InitializeCriticalSectionAndSpinCount __locking 83425->83522 83426->83420 83426->83423 83426->83425 83428 41b77e 83426->83428 83428->83420 83428->83425 83429 41b7a7 GetFileType 83428->83429 83521 4189e6 InitializeCriticalSectionAndSpinCount __locking 83428->83521 83429->83428 83432 422370 83431->83432 83433 422374 83431->83433 83432->83361 83434 416fb6 __malloc_crt 67 API calls 83433->83434 83435 422395 _realloc 83434->83435 83436 42239c FreeEnvironmentStringsW 83435->83436 83436->83361 83439 4222e6 _wparse_cmdline 83437->83439 83438 422329 _wparse_cmdline 83438->83363 83439->83438 83440 416fb6 __malloc_crt 67 API calls 83439->83440 83440->83438 83442 42209a _wcslen 83441->83442 83444 416267 83441->83444 83443 416ffb __calloc_crt 67 API calls 83442->83443 83447 4220be _wcslen 83443->83447 83444->83368 83487 4117af 67 API calls 3 library calls 83444->83487 83445 422123 83446 413a88 ___free_lc_time 67 API calls 83445->83446 83446->83444 83447->83444 83447->83445 83448 416ffb __calloc_crt 67 API calls 83447->83448 83449 422149 83447->83449 83452 422108 83447->83452 83523 426349 67 API calls __cftoa_l 83447->83523 83448->83447 83450 413a88 ___free_lc_time 67 API calls 83449->83450 83450->83444 83452->83447 83524 417d93 10 API calls 3 library calls 83452->83524 83455 41187c __IsNonwritableInCurrentImage 83454->83455 83525 418486 83455->83525 83457 41189a __initterm_e 83458 411421 __cinit 74 API calls 83457->83458 83459 4118b9 __IsNonwritableInCurrentImage __initterm 83457->83459 83458->83459 83459->83371 83461 431bcb 83460->83461 83462 40d80c 83460->83462 83529 4092c0 83462->83529 83464 40d847 83533 40eb50 83464->83533 83469 40d888 83537 411b24 67 API calls __cftoa_l 83469->83537 83471 40d877 83536 411ac6 67 API calls 4 library calls 83471->83536 83472 40d891 83538 40f370 SystemParametersInfoW SystemParametersInfoW 83472->83538 83474 40d89f 83539 40d6d0 GetCurrentDirectoryW 83474->83539 83476 40d8a7 SystemParametersInfoW 83477 40d8d4 83476->83477 83478 40d8cd FreeLibrary 83476->83478 83479 4092c0 VariantClear 83477->83479 83478->83477 83480 40d8dd 83479->83480 83481 4092c0 VariantClear 83480->83481 83482 40d8e6 83481->83482 83482->83376 83489 411a1f 67 API calls _doexit 83482->83489 83483->83349 83484->83354 83485->83360 83486->83364 83487->83368 83488->83373 83489->83376 83490->83379 83491->83390 83492->83396 83493->83406 83497 417004 83494->83497 83496 416f70 83496->83386 83496->83411 83497->83496 83498 417022 Sleep 83497->83498 83502 422452 83497->83502 83499 417037 83498->83499 83499->83496 83499->83497 83500->83415 83501->83392 83503 42245e __locking 83502->83503 83504 422476 83503->83504 83514 422495 _memset 83503->83514 83515 417f23 67 API calls __getptd_noexit 83504->83515 83506 42247b 83516 417ebb 6 API calls 2 library calls 83506->83516 83508 422507 HeapAlloc 83508->83514 83509 42248b __locking 83509->83497 83511 418407 __lock 66 API calls 83511->83514 83514->83508 83514->83509 83514->83511 83517 41a74c 5 API calls 2 library calls 83514->83517 83518 42254e LeaveCriticalSection _doexit 83514->83518 83519 411afc 6 API calls __decode_pointer 83514->83519 83515->83506 83517->83514 83518->83514 83519->83514 83520->83418 83521->83428 83522->83425 83523->83447 83524->83452 83526 41848c 83525->83526 83527 41696e __encode_pointer 6 API calls 83526->83527 83528 4184a4 83526->83528 83527->83526 83528->83457 83530 4092c8 ctype 83529->83530 83531 429db0 VariantClear 83530->83531 83532 4092d5 ctype 83530->83532 83531->83532 83532->83464 83577 40eb70 83533->83577 83536->83469 83537->83472 83538->83474 83581 401f80 83539->83581 83541 40d6f1 IsDebuggerPresent 83542 431a9d MessageBoxA 83541->83542 83543 40d6ff 83541->83543 83544 431ab6 83542->83544 83543->83544 83545 40d71f 83543->83545 83674 403e90 75 API calls 3 library calls 83544->83674 83651 40f3b0 83545->83651 83549 40d77a 83552 40d782 83549->83552 83554 431b09 SetCurrentDirectoryW 83549->83554 83550 40d73a GetFullPathNameW 83671 401440 127 API calls _wcscat 83550->83671 83553 40d78b 83552->83553 83675 43604b 6 API calls 83552->83675 83663 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 83553->83663 83554->83552 83557 431b28 83557->83553 83559 431b30 GetModuleFileNameW 83557->83559 83561 431ba4 GetForegroundWindow ShellExecuteW 83559->83561 83562 431b4c 83559->83562 83565 40d7c7 83561->83565 83676 401b70 83562->83676 83563 40d795 83571 40d7a8 83563->83571 83672 40e1e0 97 API calls _memset 83563->83672 83568 40d7d1 SetCurrentDirectoryW 83565->83568 83568->83476 83570 431b66 83683 40d3b0 75 API calls 2 library calls 83570->83683 83571->83565 83673 401000 Shell_NotifyIconW _memset 83571->83673 83574 431b72 GetForegroundWindow ShellExecuteW 83575 431b9f 83574->83575 83575->83565 83576 40eba0 LoadLibraryA GetProcAddress 83576->83471 83578 40d86e 83577->83578 83579 40eb76 LoadLibraryA 83577->83579 83578->83471 83578->83576 83579->83578 83580 40eb87 GetProcAddress 83579->83580 83580->83578 83684 40e680 75 API calls 83581->83684 83583 401f90 83685 402940 75 API calls __write_nolock 83583->83685 83585 401fa2 GetModuleFileNameW 83686 40ff90 83585->83686 83587 401fbd 83698 4107b0 75 API calls 83587->83698 83589 401fd6 83590 401b70 75 API calls 83589->83590 83591 401fe4 83590->83591 83699 4019e0 76 API calls 83591->83699 83593 401ff2 83594 4092c0 VariantClear 83593->83594 83595 402002 83594->83595 83596 401b70 75 API calls 83595->83596 83597 40201c 83596->83597 83700 4019e0 76 API calls 83597->83700 83599 40202c 83600 401b70 75 API calls 83599->83600 83601 40203c 83600->83601 83701 40c3e0 75 API calls 83601->83701 83603 40204d 83702 40c060 83603->83702 83607 40206e 83708 4115d0 79 API calls 2 library calls 83607->83708 83609 40207d 83610 42c174 83609->83610 83611 402088 83609->83611 83719 401a70 75 API calls 83610->83719 83709 4115d0 79 API calls 2 library calls 83611->83709 83614 42c189 83720 401a70 75 API calls 83614->83720 83615 402093 83615->83614 83616 40209e 83615->83616 83710 4115d0 79 API calls 2 library calls 83616->83710 83619 42c1a7 83621 42c1b0 GetModuleFileNameW 83619->83621 83620 4020a9 83620->83621 83622 4020b4 83620->83622 83721 401a70 75 API calls 83621->83721 83711 4115d0 79 API calls 2 library calls 83622->83711 83625 42c1e2 83722 40df50 75 API calls 83625->83722 83626 4020bf 83627 402107 83626->83627 83636 42c20a _wcscpy 83626->83636 83712 401a70 75 API calls 83626->83712 83630 402119 83627->83630 83627->83636 83629 42c1f1 83723 401a70 75 API calls 83629->83723 83633 42c243 83630->83633 83714 40e7e0 76 API calls 83630->83714 83634 4020e5 _wcscpy 83713 401a70 75 API calls 83634->83713 83635 42c201 83635->83636 83724 401a70 75 API calls 83636->83724 83639 402132 83715 40d030 76 API calls 83639->83715 83642 40213e 83643 4092c0 VariantClear 83642->83643 83646 402148 83643->83646 83644 402184 83648 4092c0 VariantClear 83644->83648 83646->83644 83716 40d030 76 API calls 83646->83716 83717 40e640 76 API calls 83646->83717 83718 401a70 75 API calls 83646->83718 83650 402196 ctype 83648->83650 83650->83541 83652 42ccf4 _memset 83651->83652 83653 40f3c9 83651->83653 83655 42cd05 GetOpenFileNameW 83652->83655 84385 40ffb0 76 API calls ctype 83653->84385 83655->83653 83657 40d732 83655->83657 83656 40f3d2 84386 410130 SHGetMalloc 83656->84386 83657->83549 83657->83550 83659 40f3d9 84391 410020 88 API calls __wcsicoll 83659->84391 83661 40f3e7 84392 40f400 83661->84392 83664 42b9d3 83663->83664 83665 41025a LoadImageW RegisterClassExW 83663->83665 84437 443e8f EnumResourceNamesW LoadImageW 83664->84437 84436 4102f0 7 API calls 83665->84436 83668 40d790 83670 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 83668->83670 83669 42b9da 83670->83563 83671->83549 83672->83571 83673->83565 83674->83549 83675->83557 83677 401b76 _wcslen 83676->83677 83678 41171a 75 API calls 83677->83678 83681 401bc5 83677->83681 83679 401bad _realloc 83678->83679 83680 41171a 75 API calls 83679->83680 83680->83681 83682 40d3b0 75 API calls 2 library calls 83681->83682 83682->83570 83683->83574 83684->83583 83685->83585 83725 40f5e0 83686->83725 83689 40ffa6 83689->83587 83691 42b6d8 83692 42b6e6 83691->83692 83781 434fe1 83691->83781 83694 413a88 ___free_lc_time 67 API calls 83692->83694 83695 42b6f5 83694->83695 83696 434fe1 106 API calls 83695->83696 83697 42b702 83696->83697 83697->83587 83698->83589 83699->83593 83700->83599 83701->83603 83703 41171a 75 API calls 83702->83703 83704 40c088 83703->83704 83705 41171a 75 API calls 83704->83705 83706 402061 83705->83706 83707 401a70 75 API calls 83706->83707 83707->83607 83708->83609 83709->83615 83710->83620 83711->83626 83712->83634 83713->83627 83714->83639 83715->83642 83716->83646 83717->83646 83718->83646 83719->83614 83720->83619 83721->83625 83722->83629 83723->83635 83724->83646 83785 40f580 83725->83785 83727 40f5f8 _strcat ctype 83793 40f6d0 83727->83793 83732 42b2ee 83822 4151b0 83732->83822 83734 40f679 83734->83732 83735 40f681 83734->83735 83809 414e94 83735->83809 83739 40f68b 83739->83689 83744 452574 83739->83744 83741 42b31d 83828 415484 83741->83828 83743 42b33d 83745 41557c _fseek 105 API calls 83744->83745 83746 4525df 83745->83746 84330 4523ce 83746->84330 83749 4525fc 83749->83691 83750 4151b0 __fread_nolock 81 API calls 83751 45261d 83750->83751 83752 4151b0 __fread_nolock 81 API calls 83751->83752 83753 45262e 83752->83753 83754 4151b0 __fread_nolock 81 API calls 83753->83754 83755 452649 83754->83755 83756 4151b0 __fread_nolock 81 API calls 83755->83756 83757 452666 83756->83757 83758 41557c _fseek 105 API calls 83757->83758 83759 452682 83758->83759 83760 4138ba _malloc 67 API calls 83759->83760 83761 45268e 83760->83761 83762 4138ba _malloc 67 API calls 83761->83762 83763 45269b 83762->83763 83764 4151b0 __fread_nolock 81 API calls 83763->83764 83765 4526ac 83764->83765 83766 44afdc GetSystemTimeAsFileTime 83765->83766 83767 4526bf 83766->83767 83768 4526d5 83767->83768 83769 4526fd 83767->83769 83772 413a88 ___free_lc_time 67 API calls 83768->83772 83770 452704 83769->83770 83771 45275b 83769->83771 84336 44b195 83770->84336 83775 413a88 ___free_lc_time 67 API calls 83771->83775 83773 4526df 83772->83773 83776 413a88 ___free_lc_time 67 API calls 83773->83776 83778 452759 83775->83778 83779 4526e8 83776->83779 83777 452753 83780 413a88 ___free_lc_time 67 API calls 83777->83780 83778->83691 83779->83691 83780->83778 83782 434ff1 83781->83782 83783 434feb 83781->83783 83782->83692 83784 414e94 __fcloseall 106 API calls 83783->83784 83784->83782 83786 429440 83785->83786 83787 40f589 _wcslen 83785->83787 83788 40f58f WideCharToMultiByte 83787->83788 83789 40f5d8 83788->83789 83790 40f5ad 83788->83790 83789->83727 83791 41171a 75 API calls 83790->83791 83792 40f5bb WideCharToMultiByte 83791->83792 83792->83727 83794 40f6dd _strlen 83793->83794 83841 40f790 83794->83841 83797 414e06 83861 414d40 83797->83861 83799 40f666 83799->83732 83800 40f450 83799->83800 83801 40f45a _strcat _realloc __write_nolock 83800->83801 83802 4151b0 __fread_nolock 81 API calls 83801->83802 83803 40f531 83801->83803 83805 42936d 83801->83805 83944 41557c 83801->83944 83802->83801 83803->83734 83806 41557c _fseek 105 API calls 83805->83806 83807 429394 83806->83807 83808 4151b0 __fread_nolock 81 API calls 83807->83808 83808->83803 83810 414ea0 __locking 83809->83810 83811 414ed1 83810->83811 83812 414eb4 83810->83812 83814 415965 __lock_file 68 API calls 83811->83814 83821 414ec9 __locking 83811->83821 84083 417f23 67 API calls __getptd_noexit 83812->84083 83816 414ee9 83814->83816 83815 414eb9 84084 417ebb 6 API calls 2 library calls 83815->84084 84067 414e1d 83816->84067 83821->83739 84152 41511a 83822->84152 83824 4151c8 83825 44afdc 83824->83825 84323 4431e0 83825->84323 83827 44affd 83827->83741 83829 415490 __locking 83828->83829 83830 4154bb 83829->83830 83831 41549e 83829->83831 83833 415965 __lock_file 68 API calls 83830->83833 84327 417f23 67 API calls __getptd_noexit 83831->84327 83835 4154c3 83833->83835 83834 4154a3 84328 417ebb 6 API calls 2 library calls 83834->84328 83837 4152e7 __ftell_nolock 71 API calls 83835->83837 83838 4154cf 83837->83838 84329 4154e8 LeaveCriticalSection LeaveCriticalSection _ftell 83838->84329 83840 4154b3 __locking 83840->83743 83843 40f7ae _memset 83841->83843 83842 42a349 83843->83842 83845 40f628 83843->83845 83846 415258 83843->83846 83845->83797 83847 415285 83846->83847 83848 415268 83846->83848 83847->83848 83850 41528c 83847->83850 83857 417f23 67 API calls __getptd_noexit 83848->83857 83859 41c551 103 API calls 13 library calls 83850->83859 83851 41526d 83858 417ebb 6 API calls 2 library calls 83851->83858 83854 4152b2 83855 41527d 83854->83855 83860 4191c9 101 API calls 6 library calls 83854->83860 83855->83843 83857->83851 83859->83854 83860->83855 83862 414d4c __locking 83861->83862 83863 414d5f 83862->83863 83866 414d95 83862->83866 83913 417f23 67 API calls __getptd_noexit 83863->83913 83865 414d64 83914 417ebb 6 API calls 2 library calls 83865->83914 83880 41e28c 83866->83880 83869 414d9a 83870 414da1 83869->83870 83871 414dae 83869->83871 83915 417f23 67 API calls __getptd_noexit 83870->83915 83873 414dd6 83871->83873 83874 414db6 83871->83874 83898 41dfd8 83873->83898 83916 417f23 67 API calls __getptd_noexit 83874->83916 83877 414d74 __locking @_EH4_CallFilterFunc@8 83877->83799 83881 41e298 __locking 83880->83881 83882 418407 __lock 67 API calls 83881->83882 83895 41e2a6 83882->83895 83883 41e322 83884 416fb6 __malloc_crt 67 API calls 83883->83884 83887 41e32c 83884->83887 83886 41e3b0 __locking 83886->83869 83894 41e31b 83887->83894 83923 4189e6 InitializeCriticalSectionAndSpinCount __locking 83887->83923 83889 418344 __mtinitlocknum 67 API calls 83889->83895 83891 41e351 83892 41e35c 83891->83892 83893 41e36f EnterCriticalSection 83891->83893 83896 413a88 ___free_lc_time 67 API calls 83892->83896 83893->83894 83918 41e3bb 83894->83918 83895->83883 83895->83889 83895->83894 83921 4159a6 68 API calls __lock 83895->83921 83922 415a14 LeaveCriticalSection LeaveCriticalSection _doexit 83895->83922 83896->83894 83906 41dffb __wopenfile 83898->83906 83899 41e015 83928 417f23 67 API calls __getptd_noexit 83899->83928 83901 41e01a 83929 417ebb 6 API calls 2 library calls 83901->83929 83902 41e247 83925 425db0 83902->83925 83906->83899 83912 41e1e9 83906->83912 83930 4136bc 79 API calls 2 library calls 83906->83930 83908 41e1e2 83908->83912 83931 4136bc 79 API calls 2 library calls 83908->83931 83910 41e201 83910->83912 83932 4136bc 79 API calls 2 library calls 83910->83932 83912->83899 83912->83902 83913->83865 83915->83877 83916->83877 83917 414dfc LeaveCriticalSection LeaveCriticalSection _ftell 83917->83877 83924 41832d LeaveCriticalSection 83918->83924 83920 41e3c2 83920->83886 83921->83895 83922->83895 83923->83891 83924->83920 83933 425ce4 83925->83933 83927 414de1 83927->83917 83928->83901 83930->83908 83931->83910 83932->83912 83936 425cf0 __locking 83933->83936 83934 425d03 83935 417f23 __cftoa_l 67 API calls 83934->83935 83937 425d08 83935->83937 83936->83934 83938 425d41 83936->83938 83939 417ebb __cftoa_l 6 API calls 83937->83939 83940 4255c4 __tsopen_nolock 132 API calls 83938->83940 83943 425d17 __locking 83939->83943 83941 425d5b 83940->83941 83942 425d82 __sopen_helper LeaveCriticalSection 83941->83942 83942->83943 83943->83927 83947 415588 __locking 83944->83947 83945 415596 83975 417f23 67 API calls __getptd_noexit 83945->83975 83946 4155c4 83957 415965 83946->83957 83947->83945 83947->83946 83950 41559b 83976 417ebb 6 API calls 2 library calls 83950->83976 83956 4155ab __locking 83956->83801 83958 415977 83957->83958 83959 415999 EnterCriticalSection 83957->83959 83958->83959 83960 41597f 83958->83960 83961 4155cc 83959->83961 83962 418407 __lock 67 API calls 83960->83962 83963 4154f2 83961->83963 83962->83961 83964 415502 83963->83964 83967 415512 83963->83967 84032 417f23 67 API calls __getptd_noexit 83964->84032 83966 415524 83995 41486c 83966->83995 83967->83966 83978 4152e7 83967->83978 83968 415507 83977 4155f7 LeaveCriticalSection LeaveCriticalSection _ftell 83968->83977 83975->83950 83977->83956 83979 41531a 83978->83979 83980 4152fa 83978->83980 83982 41453a __fileno 67 API calls 83979->83982 84033 417f23 67 API calls __getptd_noexit 83980->84033 83984 415320 83982->83984 83983 4152ff 84034 417ebb 6 API calls 2 library calls 83983->84034 83986 41efd4 __locking 71 API calls 83984->83986 83987 415335 83986->83987 83988 4153a9 83987->83988 83990 415364 83987->83990 83994 41530f 83987->83994 84035 417f23 67 API calls __getptd_noexit 83988->84035 83991 41efd4 __locking 71 API calls 83990->83991 83990->83994 83992 415404 83991->83992 83993 41efd4 __locking 71 API calls 83992->83993 83992->83994 83993->83994 83994->83966 83996 414885 83995->83996 84000 4148a7 83995->84000 83997 41453a __fileno 67 API calls 83996->83997 83996->84000 83998 4148a0 83997->83998 84036 41c3cf 101 API calls 4 library calls 83998->84036 84001 41453a 84000->84001 84002 41455e 84001->84002 84003 414549 84001->84003 84007 41efd4 84002->84007 84037 417f23 67 API calls __getptd_noexit 84003->84037 84005 41454e 84038 417ebb 6 API calls 2 library calls 84005->84038 84008 41efe0 __locking 84007->84008 84009 41f003 84008->84009 84010 41efe8 84008->84010 84011 41f011 84009->84011 84016 41f052 84009->84016 84059 417f36 67 API calls __getptd_noexit 84010->84059 84061 417f36 67 API calls __getptd_noexit 84011->84061 84014 41efed 84060 417f23 67 API calls __getptd_noexit 84014->84060 84015 41f016 84062 417f23 67 API calls __getptd_noexit 84015->84062 84039 41ba3b 84016->84039 84020 41f01d 84063 417ebb 6 API calls 2 library calls 84020->84063 84021 41f058 84023 41f065 84021->84023 84024 41f07b 84021->84024 84049 41ef5f 84023->84049 84064 417f23 67 API calls __getptd_noexit 84024->84064 84027 41eff5 __locking 84027->83968 84028 41f073 84066 41f0a6 LeaveCriticalSection __unlock_fhandle 84028->84066 84029 41f080 84065 417f36 67 API calls __getptd_noexit 84029->84065 84032->83968 84033->83983 84035->83994 84036->84000 84037->84005 84040 41ba47 __locking 84039->84040 84041 41baa2 84040->84041 84044 418407 __lock 67 API calls 84040->84044 84042 41bac4 __locking 84041->84042 84043 41baa7 EnterCriticalSection 84041->84043 84042->84021 84043->84042 84045 41ba73 84044->84045 84046 41ba8a 84045->84046 84048 4189e6 __mtinitlocknum InitializeCriticalSectionAndSpinCount 84045->84048 84047 41bad2 ___lock_fhandle LeaveCriticalSection 84046->84047 84047->84041 84048->84046 84050 41b9c4 __lseeki64_nolock 67 API calls 84049->84050 84051 41ef6e 84050->84051 84052 41ef84 SetFilePointer 84051->84052 84053 41ef74 84051->84053 84054 41ef9b GetLastError 84052->84054 84057 41efa3 84052->84057 84055 417f23 __cftoa_l 67 API calls 84053->84055 84054->84057 84056 41ef79 84055->84056 84056->84028 84057->84056 84058 417f49 __dosmaperr 67 API calls 84057->84058 84058->84056 84059->84014 84060->84027 84061->84015 84062->84020 84064->84029 84065->84028 84066->84027 84068 414e31 84067->84068 84069 414e4d 84067->84069 84113 417f23 67 API calls __getptd_noexit 84068->84113 84072 41486c __flush 101 API calls 84069->84072 84075 414e46 84069->84075 84071 414e36 84114 417ebb 6 API calls 2 library calls 84071->84114 84074 414e59 84072->84074 84086 41e680 84074->84086 84085 414f08 LeaveCriticalSection LeaveCriticalSection _ftell 84075->84085 84078 41453a __fileno 67 API calls 84079 414e67 84078->84079 84090 41e5b3 84079->84090 84081 414e6d 84081->84075 84082 413a88 ___free_lc_time 67 API calls 84081->84082 84082->84075 84083->83815 84085->83821 84087 41e690 84086->84087 84088 414e61 84086->84088 84087->84088 84089 413a88 ___free_lc_time 67 API calls 84087->84089 84088->84078 84089->84088 84091 41e5bf __locking 84090->84091 84092 41e5e2 84091->84092 84093 41e5c7 84091->84093 84095 41e5f0 84092->84095 84099 41e631 84092->84099 84130 417f36 67 API calls __getptd_noexit 84093->84130 84132 417f36 67 API calls __getptd_noexit 84095->84132 84097 41e5cc 84131 417f23 67 API calls __getptd_noexit 84097->84131 84098 41e5f5 84133 417f23 67 API calls __getptd_noexit 84098->84133 84102 41ba3b ___lock_fhandle 68 API calls 84099->84102 84104 41e637 84102->84104 84103 41e5fc 84134 417ebb 6 API calls 2 library calls 84103->84134 84106 41e652 84104->84106 84107 41e644 84104->84107 84135 417f23 67 API calls __getptd_noexit 84106->84135 84115 41e517 84107->84115 84108 41e5d4 __locking 84108->84081 84111 41e64c 84136 41e676 LeaveCriticalSection __unlock_fhandle 84111->84136 84113->84071 84137 41b9c4 84115->84137 84117 41e57d 84150 41b93e 68 API calls 2 library calls 84117->84150 84118 41e527 84118->84117 84120 41e55b 84118->84120 84122 41b9c4 __lseeki64_nolock 67 API calls 84118->84122 84120->84117 84123 41b9c4 __lseeki64_nolock 67 API calls 84120->84123 84121 41e585 84125 41e5a7 84121->84125 84151 417f49 67 API calls 3 library calls 84121->84151 84126 41e552 84122->84126 84124 41e567 CloseHandle 84123->84124 84124->84117 84127 41e573 GetLastError 84124->84127 84125->84111 84129 41b9c4 __lseeki64_nolock 67 API calls 84126->84129 84127->84117 84129->84120 84130->84097 84131->84108 84132->84098 84133->84103 84135->84111 84136->84108 84138 41b9d1 84137->84138 84139 41b9e9 84137->84139 84140 417f36 __locking 67 API calls 84138->84140 84142 417f36 __locking 67 API calls 84139->84142 84147 41ba2e 84139->84147 84141 41b9d6 84140->84141 84143 417f23 __cftoa_l 67 API calls 84141->84143 84144 41ba17 84142->84144 84145 41b9de 84143->84145 84146 417f23 __cftoa_l 67 API calls 84144->84146 84145->84118 84148 41ba1e 84146->84148 84147->84118 84149 417ebb __cftoa_l 6 API calls 84148->84149 84149->84147 84150->84121 84151->84125 84153 415126 __locking 84152->84153 84154 41516f 84153->84154 84155 415164 __locking 84153->84155 84157 41513a _memset 84153->84157 84156 415965 __lock_file 68 API calls 84154->84156 84155->83824 84158 415177 84156->84158 84181 417f23 67 API calls __getptd_noexit 84157->84181 84165 414f10 84158->84165 84161 415154 84182 417ebb 6 API calls 2 library calls 84161->84182 84169 414f2e _memset 84165->84169 84171 414f4c 84165->84171 84166 414f37 84234 417f23 67 API calls __getptd_noexit 84166->84234 84168 414f8b 84168->84171 84173 4150a9 _memset 84168->84173 84174 4150d5 _memset 84168->84174 84176 41453a __fileno 67 API calls 84168->84176 84184 41ed9e 84168->84184 84214 41e6b1 84168->84214 84236 41ee9b 67 API calls 3 library calls 84168->84236 84169->84166 84169->84168 84169->84171 84183 4151a6 LeaveCriticalSection LeaveCriticalSection _ftell 84171->84183 84237 417f23 67 API calls __getptd_noexit 84173->84237 84238 417f23 67 API calls __getptd_noexit 84174->84238 84176->84168 84180 414f3c 84235 417ebb 6 API calls 2 library calls 84180->84235 84181->84161 84183->84155 84185 41edaa __locking 84184->84185 84186 41edb2 84185->84186 84187 41edcd 84185->84187 84308 417f36 67 API calls __getptd_noexit 84186->84308 84189 41eddb 84187->84189 84192 41ee1c 84187->84192 84310 417f36 67 API calls __getptd_noexit 84189->84310 84190 41edb7 84309 417f23 67 API calls __getptd_noexit 84190->84309 84195 41ee29 84192->84195 84196 41ee3d 84192->84196 84194 41ede0 84311 417f23 67 API calls __getptd_noexit 84194->84311 84313 417f36 67 API calls __getptd_noexit 84195->84313 84199 41ba3b ___lock_fhandle 68 API calls 84196->84199 84202 41ee43 84199->84202 84200 41ede7 84312 417ebb 6 API calls 2 library calls 84200->84312 84201 41ee2e 84314 417f23 67 API calls __getptd_noexit 84201->84314 84205 41ee50 84202->84205 84206 41ee66 84202->84206 84204 41edbf __locking 84204->84168 84239 41e7dc 84205->84239 84315 417f23 67 API calls __getptd_noexit 84206->84315 84210 41ee6b 84316 417f36 67 API calls __getptd_noexit 84210->84316 84211 41ee5e 84317 41ee91 LeaveCriticalSection __unlock_fhandle 84211->84317 84215 41e6c1 84214->84215 84219 41e6de 84214->84219 84321 417f23 67 API calls __getptd_noexit 84215->84321 84217 41e6c6 84322 417ebb 6 API calls 2 library calls 84217->84322 84220 41e713 84219->84220 84226 41e6d6 84219->84226 84318 423600 84219->84318 84222 41453a __fileno 67 API calls 84220->84222 84223 41e727 84222->84223 84224 41ed9e __read 79 API calls 84223->84224 84225 41e72e 84224->84225 84225->84226 84227 41453a __fileno 67 API calls 84225->84227 84226->84168 84228 41e751 84227->84228 84228->84226 84229 41453a __fileno 67 API calls 84228->84229 84230 41e75d 84229->84230 84230->84226 84231 41453a __fileno 67 API calls 84230->84231 84232 41e769 84231->84232 84233 41453a __fileno 67 API calls 84232->84233 84233->84226 84234->84180 84236->84168 84237->84180 84238->84180 84240 41e813 84239->84240 84241 41e7f8 84239->84241 84243 41e822 84240->84243 84246 41e849 84240->84246 84242 417f36 __locking 67 API calls 84241->84242 84245 41e7fd 84242->84245 84244 417f36 __locking 67 API calls 84243->84244 84247 41e827 84244->84247 84249 417f23 __cftoa_l 67 API calls 84245->84249 84248 41e868 84246->84248 84259 41e87c 84246->84259 84250 417f23 __cftoa_l 67 API calls 84247->84250 84251 417f36 __locking 67 API calls 84248->84251 84260 41e805 84249->84260 84253 41e82e 84250->84253 84255 41e86d 84251->84255 84252 41e8d4 84254 417f36 __locking 67 API calls 84252->84254 84256 417ebb __cftoa_l 6 API calls 84253->84256 84257 41e8d9 84254->84257 84258 417f23 __cftoa_l 67 API calls 84255->84258 84256->84260 84261 417f23 __cftoa_l 67 API calls 84257->84261 84262 41e874 84258->84262 84259->84252 84259->84260 84263 41e8b0 84259->84263 84264 41e8f5 84259->84264 84260->84211 84261->84262 84265 417ebb __cftoa_l 6 API calls 84262->84265 84263->84252 84271 41e8bb ReadFile 84263->84271 84266 416fb6 __malloc_crt 67 API calls 84264->84266 84265->84260 84268 41e90b 84266->84268 84274 41e931 84268->84274 84275 41e913 84268->84275 84269 41ed62 GetLastError 84272 41ebe8 84269->84272 84273 41ed6f 84269->84273 84270 41e9e7 84270->84269 84278 41e9fb 84270->84278 84271->84269 84271->84270 84282 417f49 __dosmaperr 67 API calls 84272->84282 84287 41eb6d 84272->84287 84276 417f23 __cftoa_l 67 API calls 84273->84276 84279 423462 __lseeki64_nolock 69 API calls 84274->84279 84277 417f23 __cftoa_l 67 API calls 84275->84277 84280 41ed74 84276->84280 84281 41e918 84277->84281 84278->84287 84288 41ea17 84278->84288 84291 41ec2d 84278->84291 84283 41e93d 84279->84283 84284 417f36 __locking 67 API calls 84280->84284 84285 417f36 __locking 67 API calls 84281->84285 84282->84287 84283->84271 84284->84287 84285->84260 84286 413a88 ___free_lc_time 67 API calls 84286->84260 84287->84260 84287->84286 84289 41ea7d ReadFile 84288->84289 84296 41eafa 84288->84296 84292 41ea9b GetLastError 84289->84292 84301 41eaa5 84289->84301 84290 41eca5 ReadFile 84293 41ecc4 GetLastError 84290->84293 84299 41ecce 84290->84299 84291->84287 84291->84290 84292->84288 84292->84301 84293->84291 84293->84299 84294 41ebbe MultiByteToWideChar 84294->84287 84295 41ebe2 GetLastError 84294->84295 84295->84272 84296->84287 84297 41eb75 84296->84297 84298 41eb68 84296->84298 84304 41eb32 84296->84304 84297->84304 84305 41ebac 84297->84305 84300 417f23 __cftoa_l 67 API calls 84298->84300 84299->84291 84303 423462 __lseeki64_nolock 69 API calls 84299->84303 84300->84287 84301->84288 84302 423462 __lseeki64_nolock 69 API calls 84301->84302 84302->84301 84303->84299 84304->84294 84306 423462 __lseeki64_nolock 69 API calls 84305->84306 84307 41ebbb 84306->84307 84307->84294 84308->84190 84309->84204 84310->84194 84311->84200 84313->84201 84314->84200 84315->84210 84316->84211 84317->84204 84319 416fb6 __malloc_crt 67 API calls 84318->84319 84320 423615 84319->84320 84320->84220 84321->84217 84326 414cef GetSystemTimeAsFileTime __aulldiv 84323->84326 84325 4431ef 84325->83827 84326->84325 84327->83834 84329->83840 84334 4523e1 _wcscpy 84330->84334 84331 4151b0 81 API calls __fread_nolock 84331->84334 84332 44afdc GetSystemTimeAsFileTime 84332->84334 84333 452553 84333->83749 84333->83750 84334->84331 84334->84332 84334->84333 84335 41557c 105 API calls _fseek 84334->84335 84335->84334 84337 44b1b4 84336->84337 84338 44b1a6 84336->84338 84340 44b1ca 84337->84340 84341 414e06 138 API calls 84337->84341 84342 44b1c2 84337->84342 84339 414e06 138 API calls 84338->84339 84339->84337 84371 4352d1 81 API calls 2 library calls 84340->84371 84343 44b2c1 84341->84343 84342->83777 84343->84340 84345 44b2cf 84343->84345 84347 44b2dc 84345->84347 84350 414e94 __fcloseall 106 API calls 84345->84350 84346 44b20d 84348 44b211 84346->84348 84349 44b23b 84346->84349 84347->83777 84352 44b21e 84348->84352 84355 414e94 __fcloseall 106 API calls 84348->84355 84372 43526e 84349->84372 84350->84347 84353 44b22e 84352->84353 84356 414e94 __fcloseall 106 API calls 84352->84356 84353->83777 84354 44b242 84357 44b270 84354->84357 84358 44b248 84354->84358 84355->84352 84356->84353 84382 44b0af 111 API calls 84357->84382 84360 44b255 84358->84360 84362 414e94 __fcloseall 106 API calls 84358->84362 84363 44b265 84360->84363 84365 414e94 __fcloseall 106 API calls 84360->84365 84361 44b276 84383 43522c 67 API calls ___free_lc_time 84361->84383 84362->84360 84363->83777 84365->84363 84366 44b27c 84367 44b289 84366->84367 84368 414e94 __fcloseall 106 API calls 84366->84368 84369 44b299 84367->84369 84370 414e94 __fcloseall 106 API calls 84367->84370 84368->84367 84369->83777 84370->84369 84371->84346 84373 4138ba _malloc 67 API calls 84372->84373 84374 43527d 84373->84374 84375 4138ba _malloc 67 API calls 84374->84375 84376 43528d 84375->84376 84377 4138ba _malloc 67 API calls 84376->84377 84378 43529d 84377->84378 84380 4352bc 84378->84380 84384 43522c 67 API calls ___free_lc_time 84378->84384 84380->84354 84381 4352c8 84381->84354 84382->84361 84383->84366 84384->84381 84385->83656 84387 410148 SHGetDesktopFolder 84386->84387 84390 4101a3 _wcscpy 84386->84390 84388 41015a _wcscpy 84387->84388 84387->84390 84389 41018a SHGetPathFromIDListW 84388->84389 84388->84390 84389->84390 84390->83659 84391->83661 84393 40f5e0 152 API calls 84392->84393 84394 40f417 84393->84394 84395 42ca37 84394->84395 84396 40f42c 84394->84396 84397 42ca1f 84394->84397 84398 452574 140 API calls 84395->84398 84430 4037e0 139 API calls 7 library calls 84396->84430 84431 43717f 110 API calls _printf 84397->84431 84401 42ca50 84398->84401 84404 42ca76 84401->84404 84405 42ca54 84401->84405 84402 40f446 84402->83657 84403 42ca2d 84403->84395 84406 41171a 75 API calls 84404->84406 84407 434fe1 106 API calls 84405->84407 84422 42cacc ctype 84406->84422 84408 42ca5e 84407->84408 84432 43717f 110 API calls _printf 84408->84432 84410 42ccc3 84412 413a88 ___free_lc_time 67 API calls 84410->84412 84411 42ca6c 84411->84404 84413 42cccd 84412->84413 84414 434fe1 106 API calls 84413->84414 84415 42ccda 84414->84415 84419 401b70 75 API calls 84419->84422 84422->84410 84422->84419 84423 402cc0 75 API calls 2 library calls 84422->84423 84424 4026a0 84422->84424 84433 445051 75 API calls _realloc 84422->84433 84434 44c80c 87 API calls 3 library calls 84422->84434 84435 44b408 75 API calls 84422->84435 84423->84422 84425 4026af 84424->84425 84428 40276b 84424->84428 84426 41171a 75 API calls 84425->84426 84425->84428 84429 4026ee ctype 84425->84429 84426->84429 84427 41171a 75 API calls 84427->84429 84428->84422 84429->84427 84429->84428 84430->84402 84431->84403 84432->84411 84433->84422 84434->84422 84435->84422 84436->83668 84437->83669 84438 444343 84441 444326 84438->84441 84440 44434e WriteFile 84442 444340 84441->84442 84443 4442c7 84441->84443 84442->84440 84448 40e190 SetFilePointerEx 84443->84448 84445 4442e0 SetFilePointerEx 84449 40e190 SetFilePointerEx 84445->84449 84447 4442ff 84447->84440 84448->84445 84449->84447 84450 46d22f 84453 46d098 84450->84453 84452 46d241 84454 46d0b5 84453->84454 84455 46d115 84454->84455 84456 46d0b9 84454->84456 84508 45c216 78 API calls 84455->84508 84457 41171a 75 API calls 84456->84457 84459 46d0c0 84457->84459 84461 46d0cc 84459->84461 84501 40d940 76 API calls 84459->84501 84460 46d126 84462 46d0f8 84460->84462 84468 46d142 84460->84468 84502 453063 84461->84502 84463 4092c0 VariantClear 84462->84463 84465 46d0fd 84463->84465 84465->84452 84469 46d1c8 84468->84469 84471 46d158 84468->84471 84518 4676a3 78 API calls 84469->84518 84474 453063 111 API calls 84471->84474 84472 46d0ea 84472->84468 84475 46d0ee 84472->84475 84482 46d15e 84474->84482 84475->84462 84507 44ade5 CloseHandle ctype 84475->84507 84476 46d1ce 84519 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 84476->84519 84477 46d18d 84509 467fce 82 API calls 84477->84509 84479 46d196 84510 4013a0 84479->84510 84482->84477 84482->84479 84484 46d1e7 84487 4092c0 VariantClear 84484->84487 84495 46d194 84484->84495 84487->84495 84488 46d1ac 84516 40d3b0 75 API calls 2 library calls 84488->84516 84490 46d224 84490->84452 84491 46d1b8 84517 467fce 82 API calls 84491->84517 84494 46d216 84520 44ade5 CloseHandle ctype 84494->84520 84495->84490 84497 40d900 84495->84497 84498 40d917 84497->84498 84499 40d909 84497->84499 84498->84499 84500 40d91c CloseHandle 84498->84500 84499->84494 84500->84494 84501->84461 84503 45306e 84502->84503 84504 45307a 84502->84504 84503->84504 84521 452e2a 111 API calls 5 library calls 84503->84521 84506 40dfa0 83 API calls 84504->84506 84506->84472 84507->84462 84508->84460 84509->84495 84511 41171a 75 API calls 84510->84511 84512 4013c4 84511->84512 84522 401380 75 API calls 84512->84522 84514 4013d3 84515 40df50 75 API calls 84514->84515 84515->84488 84516->84491 84517->84495 84518->84476 84519->84484 84520->84490 84521->84504 84522->84514 84523 40116e 84524 401119 DefWindowProcW 84523->84524 84525 40f110 RegOpenKeyExW 84526 40f13c RegQueryValueExW RegCloseKey 84525->84526 84527 40f15f 84525->84527 84526->84527 84528 429212 84533 410b90 84528->84533 84531 411421 __cinit 74 API calls 84532 42922f 84531->84532 84534 410b9a __write_nolock 84533->84534 84535 41171a 75 API calls 84534->84535 84536 410c31 GetModuleFileNameW 84535->84536 84550 413db0 84536->84550 84538 410c66 _wcsncat 84553 413e3c 84538->84553 84541 41171a 75 API calls 84542 410ca3 _wcscpy 84541->84542 84543 410cd1 RegOpenKeyExW 84542->84543 84544 429bc3 RegQueryValueExW 84543->84544 84545 410cf7 84543->84545 84546 429cd9 RegCloseKey 84544->84546 84548 429bf2 _wcscat _wcslen _wcsncpy 84544->84548 84545->84531 84547 41171a 75 API calls 84547->84548 84548->84547 84549 429cd8 84548->84549 84549->84546 84556 413b95 84550->84556 84586 41abec 84553->84586 84557 413c2f 84556->84557 84564 413bae 84556->84564 84558 413d60 84557->84558 84559 413d7b 84557->84559 84582 417f23 67 API calls __getptd_noexit 84558->84582 84584 417f23 67 API calls __getptd_noexit 84559->84584 84562 413d65 84567 413cfb 84562->84567 84583 417ebb 6 API calls 2 library calls 84562->84583 84564->84557 84572 413c1d 84564->84572 84578 41ab19 67 API calls __cftoa_l 84564->84578 84566 413d03 84566->84557 84566->84567 84569 413d8e 84566->84569 84567->84538 84568 413cb9 84568->84557 84570 413cd6 84568->84570 84580 41ab19 67 API calls __cftoa_l 84568->84580 84585 41ab19 67 API calls __cftoa_l 84569->84585 84570->84557 84570->84567 84574 413cef 84570->84574 84572->84557 84577 413c9b 84572->84577 84579 41ab19 67 API calls __cftoa_l 84572->84579 84581 41ab19 67 API calls __cftoa_l 84574->84581 84577->84566 84577->84568 84578->84572 84579->84577 84580->84570 84581->84567 84582->84562 84584->84562 84585->84567 84587 41ac02 84586->84587 84588 41abfd 84586->84588 84595 417f23 67 API calls __getptd_noexit 84587->84595 84588->84587 84594 41ac22 84588->84594 84592 410c99 84592->84541 84593 41ac07 84596 417ebb 6 API calls 2 library calls 84593->84596 84594->84592 84597 417f23 67 API calls __getptd_noexit 84594->84597 84595->84593 84597->84593 84598 401230 84599 401241 _memset 84598->84599 84600 4012c5 84598->84600 84613 401be0 84599->84613 84602 40126b 84603 4012ae KillTimer SetTimer 84602->84603 84604 42aa61 84602->84604 84605 401298 84602->84605 84603->84600 84608 42aa8b Shell_NotifyIconW 84604->84608 84609 42aa69 Shell_NotifyIconW 84604->84609 84606 4012a2 84605->84606 84607 42aaac 84605->84607 84606->84603 84610 42aaf8 Shell_NotifyIconW 84606->84610 84611 42aad7 Shell_NotifyIconW 84607->84611 84612 42aab5 Shell_NotifyIconW 84607->84612 84608->84603 84609->84603 84610->84603 84611->84603 84612->84603 84614 401bfb 84613->84614 84634 401cde 84613->84634 84615 4013a0 75 API calls 84614->84615 84616 401c0b 84615->84616 84617 42a9a0 LoadStringW 84616->84617 84618 401c18 84616->84618 84620 42a9bb 84617->84620 84635 4021e0 84618->84635 84648 40df50 75 API calls 84620->84648 84621 401c2d 84623 401c3a 84621->84623 84624 42a9cd 84621->84624 84623->84620 84625 401c44 84623->84625 84649 40d3b0 75 API calls 2 library calls 84624->84649 84647 40d3b0 75 API calls 2 library calls 84625->84647 84627 42a9dc 84629 42a9f0 84627->84629 84632 401c53 _memset _wcscpy _wcsncpy 84627->84632 84650 40d3b0 75 API calls 2 library calls 84629->84650 84631 42a9fe 84633 401cc2 Shell_NotifyIconW 84632->84633 84633->84634 84634->84602 84636 4021f1 _wcslen 84635->84636 84637 42a598 84635->84637 84640 402205 84636->84640 84641 402226 84636->84641 84653 40c740 84637->84653 84639 42a5a2 84651 404020 75 API calls ctype 84640->84651 84652 401380 75 API calls 84641->84652 84644 40222d 84644->84639 84646 41171a 75 API calls 84644->84646 84645 40220c _realloc 84645->84621 84646->84645 84647->84632 84648->84632 84649->84627 84650->84631 84651->84645 84652->84644 84654 40c752 84653->84654 84655 40c747 84653->84655 84654->84639 84655->84654 84658 402ae0 75 API calls _realloc 84655->84658 84657 42a572 _realloc 84657->84639 84658->84657 84659 4034b0 84660 4034b9 84659->84660 84661 4034bd 84659->84661 84662 41171a 75 API calls 84661->84662 84663 42a0ba 84661->84663 84664 4034fe _realloc ctype 84662->84664 84665 431914 84666 431920 84665->84666 84667 431928 84666->84667 84668 43193d 84666->84668 84929 45e62e 116 API calls 3 library calls 84667->84929 84930 47f2b4 174 API calls 84668->84930 84671 43194a 84706 4095b0 ctype 84671->84706 84931 45e62e 116 API calls 3 library calls 84671->84931 84673 409708 84675 4097af 84675->84673 84916 40d590 VariantClear 84675->84916 84677 4315b8 WaitForSingleObject 84678 4315d6 GetExitCodeProcess CloseHandle 84677->84678 84677->84706 84920 40d590 VariantClear 84678->84920 84680 431623 Sleep 84682 43163b timeGetTime 84680->84682 84702 409894 84680->84702 84682->84702 84685 40986e Sleep 84688 409880 timeGetTime 84685->84688 84685->84702 84687 4098f1 TranslateMessage DispatchMessageW 84687->84706 84688->84702 84689 431673 CloseHandle 84689->84702 84690 43170c GetExitCodeProcess CloseHandle 84690->84702 84691 40d590 VariantClear 84691->84702 84692 46dd22 133 API calls 84692->84702 84694 46e641 134 API calls 84694->84702 84697 431781 Sleep 84697->84706 84702->84689 84702->84690 84702->84691 84702->84692 84702->84694 84702->84697 84705 4092c0 VariantClear 84702->84705 84702->84706 84917 447e59 75 API calls 84702->84917 84918 453b07 77 API calls 84702->84918 84919 4646a2 76 API calls 84702->84919 84921 444233 88 API calls _wcslen 84702->84921 84922 457509 VariantClear 84702->84922 84923 404120 84702->84923 84927 4717e3 VariantClear 84702->84927 84928 436272 6 API calls 84702->84928 84705->84702 84706->84673 84706->84675 84706->84677 84706->84680 84706->84685 84706->84687 84706->84702 84707 4319c9 VariantClear 84706->84707 84708 4092c0 VariantClear 84706->84708 84709 45e62e 116 API calls 84706->84709 84711 40b380 84706->84711 84735 409340 84706->84735 84768 409030 84706->84768 84782 40d300 84706->84782 84787 40d320 84706->84787 84793 409a40 84706->84793 84932 40e380 VariantClear ctype 84706->84932 84707->84706 84708->84706 84709->84706 84712 40b3a5 84711->84712 84713 40b53d 84711->84713 84714 430a99 84712->84714 84720 40b3b6 84712->84720 84933 45e62e 116 API calls 3 library calls 84713->84933 84934 45e62e 116 API calls 3 library calls 84714->84934 84717 40b528 84717->84706 84718 430aae 84722 4092c0 VariantClear 84718->84722 84720->84718 84723 40b3f2 84720->84723 84731 40b4fd ctype 84720->84731 84721 430dc9 84721->84721 84722->84717 84724 40b429 84723->84724 84725 40b476 ctype 84723->84725 84727 430ae9 VariantClear 84723->84727 84733 40b43b ctype 84724->84733 84935 40e380 VariantClear ctype 84724->84935 84726 40b4eb 84725->84726 84730 430d08 ctype 84725->84730 84726->84731 84936 40e380 VariantClear ctype 84726->84936 84727->84733 84728 430d41 VariantClear 84728->84731 84730->84728 84730->84731 84731->84717 84937 45e62e 116 API calls 3 library calls 84731->84937 84733->84725 84734 41171a 75 API calls 84733->84734 84734->84725 84736 409386 84735->84736 84761 409395 84735->84761 84938 4042f0 75 API calls __cinit 84736->84938 84739 42fba9 84942 45e62e 116 API calls 3 library calls 84739->84942 84741 42fc07 84944 45e62e 116 API calls 3 library calls 84741->84944 84743 42fc85 84946 4781ae 140 API calls 84743->84946 84745 42fd4f 84750 4092c0 VariantClear 84745->84750 84746 42fcd8 84948 47f2b4 174 API calls 84746->84948 84748 42fc9c 84767 409484 ctype 84748->84767 84947 45e62e 116 API calls 3 library calls 84748->84947 84749 42fd39 84950 45e62e 116 API calls 3 library calls 84749->84950 84750->84767 84753 42fce9 84753->84767 84949 45e62e 116 API calls 3 library calls 84753->84949 84755 40946f 84939 409210 VariantClear 84755->84939 84758 40947b 84762 4092c0 VariantClear 84758->84762 84760 4094c1 84760->84767 84940 404260 76 API calls 84760->84940 84761->84739 84761->84741 84761->84743 84761->84745 84761->84746 84761->84749 84761->84755 84761->84758 84761->84760 84764 4092c0 VariantClear 84761->84764 84761->84767 84941 453155 75 API calls 84761->84941 84943 40c620 118 API calls 84761->84943 84945 45e62e 116 API calls 3 library calls 84761->84945 84762->84767 84764->84761 84765 4094e1 84766 4092c0 VariantClear 84765->84766 84766->84767 84767->84706 84951 409110 117 API calls 84768->84951 84770 42ceb6 84961 410ae0 VariantClear ctype 84770->84961 84772 42cebf 84773 40906e 84773->84770 84774 42cea9 84773->84774 84776 4090a4 84773->84776 84960 45e62e 116 API calls 3 library calls 84774->84960 84952 404160 84776->84952 84779 4090f0 ctype 84779->84706 84780 4092c0 VariantClear 84781 4090be ctype 84780->84781 84781->84779 84781->84780 84783 4292e3 84782->84783 84784 40d30c 84782->84784 84785 429323 84783->84785 84786 4292fd TranslateAcceleratorW 84783->84786 84784->84706 84785->84706 84786->84784 84788 4296d0 84787->84788 84789 40d32f 84787->84789 84788->84706 84790 40d33c 84789->84790 84791 42972a IsDialogMessageW 84789->84791 85096 4340ec GetClassLongW 84789->85096 84790->84706 84791->84789 84791->84790 84794 409a66 _wcslen 84793->84794 84795 41171a 75 API calls 84794->84795 84855 40aade _realloc ctype 84794->84855 84796 409a9c _realloc 84795->84796 84798 41171a 75 API calls 84796->84798 84800 409abd 84798->84800 84799 42cee9 84801 41171a 75 API calls 84799->84801 84802 409aeb CharUpperBuffW 84800->84802 84804 409b09 ctype 84800->84804 84800->84855 84843 42cf10 _realloc 84801->84843 84802->84804 84846 409b88 ctype 84804->84846 85099 47d10e 150 API calls 84804->85099 84806 4092c0 VariantClear 84807 42e5e0 84806->84807 85131 410ae0 VariantClear ctype 84807->85131 84809 42e5f2 84810 409e4a 84812 41171a 75 API calls 84810->84812 84816 409ea4 84810->84816 84810->84843 84811 40aa5b 84813 41171a 75 API calls 84811->84813 84812->84816 84829 40aa81 _realloc ctype 84813->84829 84815 409ed0 84819 42d50d 84815->84819 84876 409ef8 _realloc ctype 84815->84876 85109 40b800 VariantClear VariantClear ctype 84815->85109 84816->84815 84817 41171a 75 API calls 84816->84817 84818 42d480 84817->84818 84822 42d491 84818->84822 85105 44b3f6 75 API calls 84818->85105 84824 42d527 84819->84824 85110 40b800 VariantClear VariantClear ctype 84819->85110 84820 42d195 VariantClear 84820->84846 84821 40a3a7 84826 40a415 84821->84826 84875 42db5c 84821->84875 85106 40df50 75 API calls 84822->85106 84824->84876 85111 40e2e0 VariantClear ctype 84824->85111 84831 41171a 75 API calls 84826->84831 84827 4092c0 VariantClear 84827->84846 84837 41171a 75 API calls 84829->84837 84849 40a41c 84831->84849 84834 41171a 75 API calls 84834->84846 84837->84855 84838 42d4a6 85107 4530b3 75 API calls 84838->85107 84840 42db96 85117 45e62e 116 API calls 3 library calls 84840->85117 84842 42d128 84845 4092c0 VariantClear 84842->84845 85130 45e62e 116 API calls 3 library calls 84843->85130 84844 42d4d7 85108 4530b3 75 API calls 84844->85108 84851 42d131 84845->84851 84846->84810 84846->84811 84846->84820 84846->84827 84846->84829 84846->84834 84846->84842 84846->84843 84847 42d20c 84846->84847 84853 42dbb9 84846->84853 85100 40c3e0 75 API calls 84846->85100 85101 40c620 118 API calls 84846->85101 85103 40be00 75 API calls 2 library calls 84846->85103 85104 40e380 VariantClear ctype 84846->85104 84847->84706 84863 40a481 84849->84863 85118 40c8a0 VariantClear ctype 84849->85118 85102 410ae0 VariantClear ctype 84851->85102 84853->84806 85098 401380 75 API calls 84855->85098 84857 402cc0 75 API calls 84857->84876 84858 41171a 75 API calls 84858->84876 84859 44b3f6 75 API calls 84859->84876 84861 4092c0 VariantClear 84891 40a534 _realloc ctype 84861->84891 84862 411421 74 API calls __cinit 84862->84876 84864 40a4ed 84863->84864 84865 42dc1e VariantClear 84863->84865 84863->84891 84868 40a4ff ctype 84864->84868 85119 40e380 VariantClear ctype 84864->85119 84865->84868 84870 41171a 75 API calls 84868->84870 84868->84891 84870->84891 84873 42deb6 VariantClear 84873->84891 84874 40a73c 84877 42e237 84874->84877 84884 40a76b 84874->84884 85116 4721e5 VariantClear 84875->85116 84876->84821 84876->84840 84876->84855 84876->84857 84876->84858 84876->84859 84876->84862 84876->84875 84881 40a053 84876->84881 85112 45ee98 75 API calls 84876->85112 85113 4019e0 76 API calls 84876->85113 85114 404260 76 API calls 84876->85114 85115 409210 VariantClear 84876->85115 85123 46e709 VariantClear VariantClear ctype 84877->85123 84878 42dfe9 VariantClear 84878->84891 84879 42df47 VariantClear 84879->84891 84881->84706 84882 40a7a2 84894 40a7ad ctype 84882->84894 85124 40b800 VariantClear VariantClear ctype 84882->85124 84883 40e380 VariantClear 84883->84891 84884->84882 84906 40a800 ctype 84884->84906 85097 40b800 VariantClear VariantClear ctype 84884->85097 84887 41171a 75 API calls 84887->84891 84888 41171a 75 API calls 84893 42dd10 VariantInit VariantCopy 84888->84893 84889 40a8b0 84900 40a8c2 ctype 84889->84900 85126 40e380 VariantClear ctype 84889->85126 84890 42e312 84892 42e337 VariantClear 84890->84892 84890->84900 84891->84861 84891->84873 84891->84874 84891->84877 84891->84878 84891->84879 84891->84883 84891->84887 84891->84888 85120 46e9cd 75 API calls 84891->85120 85121 409210 VariantClear 84891->85121 85122 44cc6c VariantClear ctype 84891->85122 84892->84900 84893->84891 84896 42dd30 VariantClear 84893->84896 84895 40a7ee 84894->84895 84902 42e2a7 VariantClear 84894->84902 84894->84906 84895->84906 85125 40e380 VariantClear ctype 84895->85125 84896->84891 84897 42e3b2 84903 42e3da VariantClear 84897->84903 84907 40a91a ctype 84897->84907 84900->84897 84901 40a908 84900->84901 84901->84907 85127 40e380 VariantClear ctype 84901->85127 84902->84906 84903->84907 84904 42e47f 84910 42e4a3 VariantClear 84904->84910 84915 40a957 ctype 84904->84915 84906->84889 84906->84890 84907->84904 84908 40a945 84907->84908 84908->84915 85128 40e380 VariantClear ctype 84908->85128 84910->84915 84912 40aa22 ctype 84912->84706 84913 42e559 VariantClear 84913->84915 84915->84912 84915->84913 85129 40e380 VariantClear ctype 84915->85129 84916->84673 84917->84702 84918->84702 84919->84702 84920->84702 84921->84702 84922->84702 84924 40412e 84923->84924 84925 4092c0 VariantClear 84924->84925 84926 404138 84925->84926 84926->84697 84927->84702 84928->84702 84929->84706 84930->84671 84931->84706 84932->84706 84933->84714 84934->84718 84935->84733 84936->84731 84937->84721 84938->84761 84939->84758 84940->84765 84941->84761 84942->84767 84943->84761 84944->84767 84945->84761 84946->84748 84947->84767 84948->84753 84949->84767 84950->84745 84951->84773 84953 4092c0 VariantClear 84952->84953 84954 40416e 84953->84954 84955 404120 VariantClear 84954->84955 84956 40419b 84955->84956 84962 4734b7 84956->84962 85006 40efe0 84956->85006 84957 4041c6 84957->84770 84957->84781 84960->84770 84961->84772 84963 453063 111 API calls 84962->84963 84964 4734d7 84963->84964 84965 473545 84964->84965 84966 47350c 84964->84966 85014 463c42 84965->85014 84967 4092c0 VariantClear 84966->84967 84974 473514 84967->84974 84969 473558 84970 47355c 84969->84970 84987 473595 84969->84987 84971 4092c0 VariantClear 84970->84971 84980 473564 84971->84980 84972 473616 85027 463d7e 84972->85027 84974->84957 84975 473622 84977 473697 84975->84977 84978 47362c 84975->84978 84976 453063 111 API calls 84976->84987 85061 457838 84977->85061 84981 4092c0 VariantClear 84978->84981 84980->84957 84984 473634 84981->84984 84984->84957 84986 473655 84989 4092c0 VariantClear 84986->84989 84987->84972 84987->84976 84987->84986 85073 462f5a 87 API calls __wcsicoll 84987->85073 85000 47365d 84989->85000 84990 4736b0 85074 45e62e 116 API calls 3 library calls 84990->85074 84991 4736c9 85075 40e7e0 76 API calls 84991->85075 84994 4736ba GetCurrentProcess TerminateProcess 84994->84991 84995 4736db 85002 4736ff 84995->85002 85076 40d030 76 API calls 84995->85076 84996 473731 85003 473744 FreeLibrary 84996->85003 85004 47374b 84996->85004 84998 4736f1 85077 46b945 134 API calls 2 library calls 84998->85077 85000->84957 85002->84996 85078 40d030 76 API calls 85002->85078 85079 46b945 134 API calls 2 library calls 85002->85079 85003->85004 85004->84957 85007 40eff5 CreateFileW 85006->85007 85008 4299bf 85006->85008 85009 40f017 85007->85009 85008->85009 85010 4299c4 CreateFileW 85008->85010 85009->84957 85010->85009 85011 4299ea 85010->85011 85095 40e0d0 SetFilePointerEx SetFilePointerEx 85011->85095 85013 4299f5 85013->85009 85080 45335b 76 API calls 85014->85080 85016 463c5d 85081 442c52 80 API calls _wcslen 85016->85081 85018 463c72 85020 40c060 75 API calls 85018->85020 85026 463cac 85018->85026 85021 463c8e 85020->85021 85082 4608ce 75 API calls _realloc 85021->85082 85023 463ca4 85024 40c740 75 API calls 85023->85024 85024->85026 85025 463cf7 85025->84969 85026->85025 85083 462f5a 87 API calls __wcsicoll 85026->85083 85028 453063 111 API calls 85027->85028 85029 463d99 85028->85029 85030 463de0 85029->85030 85031 463dca 85029->85031 85085 40c760 78 API calls 85030->85085 85084 453081 111 API calls 85031->85084 85034 463dd0 LoadLibraryW 85043 463e09 85034->85043 85035 463de7 85053 463e19 85035->85053 85086 40c760 78 API calls 85035->85086 85037 463dfb 85037->85053 85087 40c760 78 API calls 85037->85087 85038 463e3e 85040 463e4e 85038->85040 85041 463e7b 85038->85041 85088 40d500 75 API calls 85040->85088 85090 40c760 78 API calls 85041->85090 85043->85038 85043->85053 85045 463e57 85089 45efe7 77 API calls ctype 85045->85089 85046 463e82 GetProcAddress 85049 463e90 85046->85049 85048 463e62 GetProcAddress 85051 463e79 85048->85051 85050 463edf 85049->85050 85049->85051 85049->85053 85050->85053 85054 463eef FreeLibrary 85050->85054 85051->85049 85091 403470 75 API calls _realloc 85051->85091 85053->84975 85054->85053 85055 463eb4 85092 40d500 75 API calls 85055->85092 85057 463ebd 85093 45efe7 77 API calls ctype 85057->85093 85059 463ec8 GetProcAddress 85094 401330 ctype 85059->85094 85062 457a4c 85061->85062 85068 45785f _strcat _wcslen _wcscpy ctype 85061->85068 85069 410d40 85062->85069 85063 453081 111 API calls 85063->85068 85064 443576 78 API calls 85064->85068 85065 40c760 78 API calls 85065->85068 85066 4138ba 67 API calls _malloc 85066->85068 85067 40f580 77 API calls 85067->85068 85068->85062 85068->85063 85068->85064 85068->85065 85068->85066 85068->85067 85070 410d55 85069->85070 85071 410ded VirtualProtect 85070->85071 85072 410dbb 85070->85072 85071->85072 85072->84990 85072->84991 85073->84987 85074->84994 85075->84995 85076->84998 85077->85002 85078->85002 85079->85002 85080->85016 85081->85018 85082->85023 85083->85025 85084->85034 85085->85035 85086->85037 85087->85043 85088->85045 85089->85048 85090->85046 85091->85055 85092->85057 85093->85059 85094->85050 85095->85013 85096->84789 85097->84882 85098->84799 85099->84804 85100->84846 85101->84846 85102->84912 85103->84846 85104->84846 85105->84822 85106->84838 85107->84844 85108->84815 85109->84819 85110->84824 85111->84876 85112->84876 85113->84876 85114->84876 85115->84876 85116->84840 85117->84853 85118->84849 85119->84868 85120->84891 85121->84891 85122->84891 85123->84882 85124->84894 85125->84906 85126->84900 85127->84907 85128->84915 85129->84915 85130->84853 85131->84809 85132 42919b 85137 40ef10 85132->85137 85135 411421 __cinit 74 API calls 85136 4291aa 85135->85136 85138 41171a 75 API calls 85137->85138 85139 40ef17 85138->85139 85140 42ad48 85139->85140 85145 40ef40 74 API calls __cinit 85139->85145 85142 40ef2a 85146 40e470 85142->85146 85145->85142 85147 40c060 75 API calls 85146->85147 85148 40e483 GetVersionExW 85147->85148 85149 4021e0 75 API calls 85148->85149 85150 40e4bb 85149->85150 85172 40e600 85150->85172 85155 42accc 85158 42ad28 GetSystemInfo 85155->85158 85162 42ad38 GetSystemInfo 85158->85162 85159 40e557 GetCurrentProcess 85192 40ee30 LoadLibraryA GetProcAddress 85159->85192 85160 40e56c 85160->85162 85185 40eee0 85160->85185 85165 40e5c9 85189 40eea0 85165->85189 85168 40e5e0 85170 40e5f1 FreeLibrary 85168->85170 85171 40e5f4 85168->85171 85169 40e5dd FreeLibrary 85169->85168 85170->85171 85171->85135 85173 40e60b 85172->85173 85174 40c740 75 API calls 85173->85174 85175 40e4c2 85174->85175 85176 40e620 85175->85176 85177 40e62a 85176->85177 85178 42ac93 85177->85178 85179 40c740 75 API calls 85177->85179 85180 40e4ce 85179->85180 85180->85155 85181 40ee70 85180->85181 85182 40e551 85181->85182 85183 40ee76 LoadLibraryA 85181->85183 85182->85159 85182->85160 85183->85182 85184 40ee87 GetProcAddress 85183->85184 85184->85182 85186 40e5bf 85185->85186 85187 40eee6 LoadLibraryA 85185->85187 85186->85158 85186->85165 85187->85186 85188 40eef7 GetProcAddress 85187->85188 85188->85186 85193 40eec0 LoadLibraryA GetProcAddress 85189->85193 85191 40e5d3 GetNativeSystemInfo 85191->85168 85191->85169 85192->85160 85193->85191 85194 42e89e 85201 40c000 85194->85201 85196 42e8ac 85197 409a40 165 API calls 85196->85197 85198 42e8ca 85197->85198 85212 44b92e VariantClear 85198->85212 85200 42f3ae 85202 40c014 85201->85202 85203 40c007 85201->85203 85205 40c01a 85202->85205 85206 40c02c 85202->85206 85213 409210 VariantClear 85203->85213 85214 409210 VariantClear 85205->85214 85209 41171a 75 API calls 85206->85209 85207 40c00f 85207->85196 85211 40c033 85209->85211 85210 40c023 85210->85196 85211->85196 85212->85200 85213->85207 85214->85210 85215 4368908 85229 4366558 85215->85229 85217 43689da 85232 43687f8 85217->85232 85219 4368a03 CreateFileW 85221 4368a57 85219->85221 85222 4368a52 85219->85222 85221->85222 85223 4368a6e VirtualAlloc 85221->85223 85223->85222 85224 4368a8c ReadFile 85223->85224 85224->85222 85225 4368aa7 85224->85225 85226 43677f8 13 API calls 85225->85226 85227 4368ada 85226->85227 85228 4368afd ExitProcess 85227->85228 85228->85222 85235 4369a08 GetPEB 85229->85235 85231 4366be3 85231->85217 85233 4368801 Sleep 85232->85233 85234 436880f 85233->85234 85236 4369a32 85235->85236 85236->85231
                                                                                                        APIs
                                                                                                        • _wcslen.LIBCMT ref: 00409A61
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                        • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                        • String ID: 0vH$4RH
                                                                                                        • API String ID: 1143807570-2085553193
                                                                                                        • Opcode ID: 871ee0cf3e7049cfc52ffc1c0c6a20d390630c46fc92d40781a439c75a0ca281
                                                                                                        • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
                                                                                                        • Opcode Fuzzy Hash: 871ee0cf3e7049cfc52ffc1c0c6a20d390630c46fc92d40781a439c75a0ca281
                                                                                                        • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1266 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 1275 40e506-40e509 1266->1275 1276 42accc-42acd1 1266->1276 1277 40e540-40e555 call 40ee70 1275->1277 1278 40e50b-40e51c 1275->1278 1279 42acd3-42acdb 1276->1279 1280 42acdd-42ace0 1276->1280 1297 40e557-40e573 GetCurrentProcess call 40ee30 1277->1297 1298 40e579-40e5a8 1277->1298 1281 40e522-40e525 1278->1281 1282 42ac9b-42aca7 1278->1282 1284 42ad12-42ad20 1279->1284 1285 42ace2-42aceb 1280->1285 1286 42aced-42acf0 1280->1286 1281->1277 1288 40e527-40e537 1281->1288 1290 42acb2-42acba 1282->1290 1291 42aca9-42acad 1282->1291 1296 42ad28-42ad2d GetSystemInfo 1284->1296 1285->1284 1286->1284 1287 42acf2-42ad06 1286->1287 1292 42ad08-42ad0c 1287->1292 1293 42ad0e 1287->1293 1294 42acbf-42acc7 1288->1294 1295 40e53d 1288->1295 1290->1277 1291->1277 1292->1284 1293->1284 1294->1277 1295->1277 1300 42ad38-42ad3d GetSystemInfo 1296->1300 1297->1298 1308 40e575 1297->1308 1298->1300 1301 40e5ae-40e5c3 call 40eee0 1298->1301 1301->1296 1305 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 1301->1305 1310 40e5e0-40e5ef 1305->1310 1311 40e5dd-40e5de FreeLibrary 1305->1311 1308->1298 1312 40e5f1-40e5f2 FreeLibrary 1310->1312 1313 40e5f4-40e5ff 1310->1313 1311->1310 1312->1313
                                                                                                        APIs
                                                                                                        • GetVersionExW.KERNEL32 ref: 0040E495
                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                        • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
                                                                                                        • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
                                                                                                        • FreeLibrary.KERNEL32(?), ref: 0040E5DE
                                                                                                        • FreeLibrary.KERNEL32(?), ref: 0040E5F2
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
                                                                                                        • String ID: pMH
                                                                                                        • API String ID: 2923339712-2522892712
                                                                                                        • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                        • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
                                                                                                        • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                        • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
                                                                                                        APIs
                                                                                                        • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
                                                                                                        • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                        • String ID: IsThemeActive$uxtheme.dll
                                                                                                        • API String ID: 2574300362-3542929980
                                                                                                        • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                        • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
                                                                                                        • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                        • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28

                                                                                                        Control-flow Graph

                                                                                                        APIs
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
                                                                                                        • __wsplitpath.LIBCMT ref: 00410C61
                                                                                                          • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                        • _wcsncat.LIBCMT ref: 00410C78
                                                                                                        • __wmakepath.LIBCMT ref: 00410C94
                                                                                                          • Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52
                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                        • _wcscpy.LIBCMT ref: 00410CCC
                                                                                                        • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
                                                                                                        • RegQueryValueExW.ADVAPI32 ref: 00429BE4
                                                                                                        • _wcscat.LIBCMT ref: 00429C43
                                                                                                        • _wcslen.LIBCMT ref: 00429C55
                                                                                                        • _wcslen.LIBCMT ref: 00429C66
                                                                                                        • _wcscat.LIBCMT ref: 00429C80
                                                                                                        • _wcsncpy.LIBCMT ref: 00429CC0
                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00429CDE
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                        • String ID: Include$Software\AutoIt v3\AutoIt$\
                                                                                                        • API String ID: 1004883554-2276155026
                                                                                                        • Opcode ID: d7f6643cad26fd3001d91627fc5ef1af4f656d40d4c5ca14c02d7ab544e78cf5
                                                                                                        • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
                                                                                                        • Opcode Fuzzy Hash: d7f6643cad26fd3001d91627fc5ef1af4f656d40d4c5ca14c02d7ab544e78cf5
                                                                                                        • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A
                                                                                                        APIs
                                                                                                          • Part of subcall function 00409A40: _wcslen.LIBCMT ref: 00409A61
                                                                                                          • Part of subcall function 00409A40: CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                        • Sleep.KERNEL32(0000000A), ref: 00409870
                                                                                                        • timeGetTime.WINMM ref: 00409880
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: BuffCharSleepTimeUpper_wcslentime
                                                                                                        • String ID:
                                                                                                        • API String ID: 3219444185-0
                                                                                                        • Opcode ID: b124ae733e2c30a8df030179fd7ebda2966fc041c6879d6beed06594e2dda547
                                                                                                        • Instruction ID: 79dfb759edd1749a95aa3438e3198289cebfc990e9c1b7da565b255c5aac8c6d
                                                                                                        • Opcode Fuzzy Hash: b124ae733e2c30a8df030179fd7ebda2966fc041c6879d6beed06594e2dda547
                                                                                                        • Instruction Fuzzy Hash: D422F171608342ABC724DF64C984BABB7A0BF89304F14492FE54997392D77CEC45CB9A

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1156 4161c2-4161d1 1157 4161d3-4161df 1156->1157 1158 4161fa 1156->1158 1157->1158 1159 4161e1-4161e8 1157->1159 1160 4161fd-416209 call 41aa31 1158->1160 1159->1158 1161 4161ea-4161f8 1159->1161 1164 416213-41621a call 416e29 1160->1164 1165 41620b-416212 call 41616a 1160->1165 1161->1160 1170 416224-416233 call 41843a call 41b669 1164->1170 1171 41621c-416223 call 41616a 1164->1171 1165->1164 1178 416235-41623c call 4117af 1170->1178 1179 41623d-416258 GetCommandLineW call 42235f call 4222b1 1170->1179 1171->1170 1178->1179 1186 416262-416269 call 422082 1179->1186 1187 41625a-416261 call 4117af 1179->1187 1192 416273-41627c call 41186e 1186->1192 1193 41626b-416272 call 4117af 1186->1193 1187->1186 1198 416285-41628d call 42203c 1192->1198 1199 41627e-416284 call 4117af 1192->1199 1193->1192 1204 416295-416297 1198->1204 1205 41628f-416293 1198->1205 1199->1198 1206 416298-4162a0 call 40d7f0 1204->1206 1205->1206 1208 4162a5-4162ab 1206->1208 1209 4162b3-41630f call 411a4b call 4171d1 1208->1209 1210 4162ad-4162ae call 411a1f 1208->1210 1210->1209
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __amsg_exit$_fast_error_exit$CommandInitializeLine__cinit__ioinit__mtinit__wsetargv__wsetenvp__wwincmdln
                                                                                                        • String ID:
                                                                                                        • API String ID: 2477803136-0
                                                                                                        • Opcode ID: 5c6ad9204277a855c32b49e0d8ca3a5fd5782e976c2a5896ff1cb7bad4d5bdf3
                                                                                                        • Instruction ID: 5d71fe406d9f608d9de966b229f2038f561e79c4b175df4472a1e640f9164680
                                                                                                        • Opcode Fuzzy Hash: 5c6ad9204277a855c32b49e0d8ca3a5fd5782e976c2a5896ff1cb7bad4d5bdf3
                                                                                                        • Instruction Fuzzy Hash: 6A21A671D00315A9DB14BBB2A9467EE2664AF1074CF1144AFF9056A2D3EEBCC8C1461D

                                                                                                        Control-flow Graph

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __fread_nolock$_fseek_wcscpy
                                                                                                        • String ID: FILE
                                                                                                        • API String ID: 3888824918-3121273764
                                                                                                        • Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                        • Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
                                                                                                        • Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                        • Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA

                                                                                                        Control-flow Graph

                                                                                                        APIs
                                                                                                        • GetSysColorBrush.USER32 ref: 00410326
                                                                                                        • RegisterClassExW.USER32 ref: 00410359
                                                                                                        • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                        • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                        • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                        • ImageList_ReplaceIcon.COMCTL32(00A20F00,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                        • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                        • API String ID: 2914291525-1005189915
                                                                                                        • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                        • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
                                                                                                        • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                        • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A

                                                                                                        Control-flow Graph

                                                                                                        APIs
                                                                                                        • GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                        • LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                        • LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                        • LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                        • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                        • RegisterClassExW.USER32 ref: 004102C6
                                                                                                          • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                                                                                                          • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                                                                                                          • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                          • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                          • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                          • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                          • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(00A20F00,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                        • String ID: #$0$PGH
                                                                                                        • API String ID: 423443420-3673556320
                                                                                                        • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                        • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
                                                                                                        • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                        • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99

                                                                                                        Control-flow Graph

                                                                                                        APIs
                                                                                                        • _fseek.LIBCMT ref: 004525DA
                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                          • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                          • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                        • __fread_nolock.LIBCMT ref: 00452618
                                                                                                        • __fread_nolock.LIBCMT ref: 00452629
                                                                                                        • __fread_nolock.LIBCMT ref: 00452644
                                                                                                        • __fread_nolock.LIBCMT ref: 00452661
                                                                                                        • _fseek.LIBCMT ref: 0045267D
                                                                                                        • _malloc.LIBCMT ref: 00452689
                                                                                                        • _malloc.LIBCMT ref: 00452696
                                                                                                        • __fread_nolock.LIBCMT ref: 004526A7
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __fread_nolock$_fseek_malloc_wcscpy
                                                                                                        • String ID:
                                                                                                        • API String ID: 1911931848-0
                                                                                                        • Opcode ID: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                                        • Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
                                                                                                        • Opcode Fuzzy Hash: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                                        • Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1356 40f450-40f45c call 425210 1359 40f460-40f478 1356->1359 1359->1359 1360 40f47a-40f4a8 call 413990 call 410f70 1359->1360 1365 40f4b0-40f4d1 call 4151b0 1360->1365 1368 40f531 1365->1368 1369 40f4d3-40f4da 1365->1369 1370 40f536-40f540 1368->1370 1371 40f4dc-40f4de 1369->1371 1372 40f4fd-40f517 call 41557c 1369->1372 1373 40f4e0-40f4e2 1371->1373 1376 40f51c-40f51f 1372->1376 1375 40f4e6-40f4ed 1373->1375 1377 40f521-40f52c 1375->1377 1378 40f4ef-40f4f2 1375->1378 1376->1365 1381 40f543-40f54e 1377->1381 1382 40f52e-40f52f 1377->1382 1379 42937a-4293a0 call 41557c call 4151b0 1378->1379 1380 40f4f8-40f4fb 1378->1380 1393 4293a5-4293c3 call 4151d0 1379->1393 1380->1372 1380->1373 1384 40f550-40f553 1381->1384 1385 40f555-40f560 1381->1385 1382->1378 1384->1378 1387 429372 1385->1387 1388 40f566-40f571 1385->1388 1387->1379 1390 429361-429367 1388->1390 1391 40f577-40f57a 1388->1391 1390->1375 1392 42936d 1390->1392 1391->1378 1392->1387 1393->1370
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __fread_nolock_fseek_strcat
                                                                                                        • String ID: AU3!$EA06
                                                                                                        • API String ID: 3818483258-2658333250
                                                                                                        • Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                        • Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
                                                                                                        • Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                        • Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1396 410130-410142 SHGetMalloc 1397 410148-410158 SHGetDesktopFolder 1396->1397 1398 42944f-429459 call 411691 1396->1398 1399 4101d1-4101e0 1397->1399 1400 41015a-410188 call 411691 1397->1400 1399->1398 1406 4101e6-4101ee 1399->1406 1408 4101c5-4101ce 1400->1408 1409 41018a-4101a1 SHGetPathFromIDListW 1400->1409 1408->1399 1410 4101a3-4101b1 call 411691 1409->1410 1411 4101b4-4101c0 1409->1411 1410->1411 1411->1408
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcscpy$DesktopFolderFromListMallocPath
                                                                                                        • String ID: C:\Users\user\Desktop\fAzUnj6Djg.exe
                                                                                                        • API String ID: 192938534-1831563203
                                                                                                        • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                        • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
                                                                                                        • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                        • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1414 401230-40123b 1415 401241-401272 call 4131f0 call 401be0 1414->1415 1416 4012c5-4012cd 1414->1416 1421 401274-401292 1415->1421 1422 4012ae-4012bf KillTimer SetTimer 1415->1422 1423 42aa61-42aa67 1421->1423 1424 401298-40129c 1421->1424 1422->1416 1427 42aa8b-42aaa7 Shell_NotifyIconW 1423->1427 1428 42aa69-42aa86 Shell_NotifyIconW 1423->1428 1425 4012a2-4012a8 1424->1425 1426 42aaac-42aab3 1424->1426 1425->1422 1429 42aaf8-42ab15 Shell_NotifyIconW 1425->1429 1430 42aad7-42aaf3 Shell_NotifyIconW 1426->1430 1431 42aab5-42aad2 Shell_NotifyIconW 1426->1431 1427->1422 1428->1422 1429->1422 1430->1422 1431->1422
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 00401257
                                                                                                          • Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
                                                                                                          • Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                          • Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
                                                                                                          • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                        • KillTimer.USER32(?,?), ref: 004012B0
                                                                                                        • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
                                                                                                        • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
                                                                                                        • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
                                                                                                        • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
                                                                                                        • String ID:
                                                                                                        • API String ID: 1792922140-0
                                                                                                        • Opcode ID: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                        • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
                                                                                                        • Opcode Fuzzy Hash: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                        • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1432 4368b58-4368c06 call 4366558 1435 4368c0d-4368c33 call 4369a68 CreateFileW 1432->1435 1438 4368c35 1435->1438 1439 4368c3a-4368c4a 1435->1439 1440 4368d85-4368d89 1438->1440 1444 4368c51-4368c6b VirtualAlloc 1439->1444 1445 4368c4c 1439->1445 1441 4368dcb-4368dce 1440->1441 1442 4368d8b-4368d8f 1440->1442 1446 4368dd1-4368dd8 1441->1446 1447 4368d91-4368d94 1442->1447 1448 4368d9b-4368d9f 1442->1448 1449 4368c72-4368c89 ReadFile 1444->1449 1450 4368c6d 1444->1450 1445->1440 1451 4368e2d-4368e42 1446->1451 1452 4368dda-4368de5 1446->1452 1447->1448 1453 4368da1-4368dab 1448->1453 1454 4368daf-4368db3 1448->1454 1457 4368c90-4368cd0 VirtualAlloc 1449->1457 1458 4368c8b 1449->1458 1450->1440 1461 4368e44-4368e4f VirtualFree 1451->1461 1462 4368e52-4368e5a 1451->1462 1459 4368de7 1452->1459 1460 4368de9-4368df5 1452->1460 1453->1454 1455 4368db5-4368dbf 1454->1455 1456 4368dc3 1454->1456 1455->1456 1456->1441 1463 4368cd7-4368cf2 call 4369cb8 1457->1463 1464 4368cd2 1457->1464 1458->1440 1459->1451 1465 4368df7-4368e07 1460->1465 1466 4368e09-4368e15 1460->1466 1461->1462 1472 4368cfd-4368d07 1463->1472 1464->1440 1468 4368e2b 1465->1468 1469 4368e17-4368e20 1466->1469 1470 4368e22-4368e28 1466->1470 1468->1446 1469->1468 1470->1468 1473 4368d3a-4368d4e call 4369ac8 1472->1473 1474 4368d09-4368d38 call 4369cb8 1472->1474 1479 4368d52-4368d56 1473->1479 1480 4368d50 1473->1480 1474->1472 1482 4368d62-4368d66 1479->1482 1483 4368d58-4368d5c CloseHandle 1479->1483 1480->1440 1484 4368d76-4368d7f 1482->1484 1485 4368d68-4368d73 VirtualFree 1482->1485 1483->1482 1484->1435 1484->1440 1485->1484
                                                                                                        APIs
                                                                                                        • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 04368C29
                                                                                                        • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 04368E4F
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712385412.0000000004366000.00000040.00000020.00020000.00000000.sdmp, Offset: 04366000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4366000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateFileFreeVirtual
                                                                                                        • String ID:
                                                                                                        • API String ID: 204039940-0
                                                                                                        • Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                                                                        • Instruction ID: baa809cd2c3e5b9db9c0e75b6ca9c9520fbd1126fe2f5da4856d24df27a7a91e
                                                                                                        • Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                                                                        • Instruction Fuzzy Hash: 42A11B70E01209EBDF18DFA4C894BEEB7B5BF48304F109559E602BB284D775AA45CF64

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1486 414f10-414f2c 1487 414f4f 1486->1487 1488 414f2e-414f31 1486->1488 1490 414f51-414f55 1487->1490 1488->1487 1489 414f33-414f35 1488->1489 1491 414f37-414f46 call 417f23 1489->1491 1492 414f56-414f5b 1489->1492 1504 414f47-414f4c call 417ebb 1491->1504 1493 414f6a-414f6d 1492->1493 1494 414f5d-414f68 1492->1494 1497 414f7a-414f7c 1493->1497 1498 414f6f-414f77 call 4131f0 1493->1498 1494->1493 1496 414f8b-414f9e 1494->1496 1502 414fa0-414fa6 1496->1502 1503 414fa8 1496->1503 1497->1491 1501 414f7e-414f89 1497->1501 1498->1497 1501->1491 1501->1496 1506 414faf-414fb1 1502->1506 1503->1506 1504->1487 1508 4150a1-4150a4 1506->1508 1509 414fb7-414fbe 1506->1509 1508->1490 1511 414fc0-414fc5 1509->1511 1512 415004-415007 1509->1512 1511->1512 1515 414fc7 1511->1515 1513 415071-415072 call 41e6b1 1512->1513 1514 415009-41500d 1512->1514 1523 415077-41507b 1513->1523 1517 41500f-415018 1514->1517 1518 41502e-415035 1514->1518 1519 415102 1515->1519 1520 414fcd-414fd1 1515->1520 1524 415023-415028 1517->1524 1525 41501a-415021 1517->1525 1527 415037 1518->1527 1528 415039-41503c 1518->1528 1526 415106-41510f 1519->1526 1521 414fd3 1520->1521 1522 414fd5-414fd8 1520->1522 1521->1522 1529 4150a9-4150af 1522->1529 1530 414fde-414fff call 41ee9b 1522->1530 1523->1526 1531 415081-415085 1523->1531 1532 41502a-41502c 1524->1532 1525->1532 1526->1490 1527->1528 1533 415042-41504e call 41453a call 41ed9e 1528->1533 1534 4150d5-4150d9 1528->1534 1539 4150b1-4150bd call 4131f0 1529->1539 1540 4150c0-4150d0 call 417f23 1529->1540 1547 415099-41509b 1530->1547 1531->1534 1538 415087-415096 1531->1538 1532->1528 1554 415053-415058 1533->1554 1536 4150eb-4150fd call 417f23 1534->1536 1537 4150db-4150e8 call 4131f0 1534->1537 1536->1504 1537->1536 1538->1547 1539->1540 1540->1504 1547->1508 1547->1509 1555 415114-415118 1554->1555 1556 41505e-415061 1554->1556 1555->1526 1556->1519 1557 415067-41506f 1556->1557 1557->1547
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                                        • String ID:
                                                                                                        • API String ID: 3886058894-0
                                                                                                        • Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                        • Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
                                                                                                        • Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                        • Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1558 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
                                                                                                        APIs
                                                                                                        • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                        • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                        • ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                        • ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$CreateShow
                                                                                                        • String ID: AutoIt v3$edit
                                                                                                        • API String ID: 1584632944-3779509399
                                                                                                        • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                        • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
                                                                                                        • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                        • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1559 4368908-4368a50 call 4366558 call 43687f8 CreateFileW 1566 4368a57-4368a67 1559->1566 1567 4368a52 1559->1567 1570 4368a6e-4368a88 VirtualAlloc 1566->1570 1571 4368a69 1566->1571 1568 4368b07-4368b0c 1567->1568 1572 4368a8c-4368aa3 ReadFile 1570->1572 1573 4368a8a 1570->1573 1571->1568 1574 4368aa7-4368ae1 call 4368838 call 43677f8 1572->1574 1575 4368aa5 1572->1575 1573->1568 1580 4368ae3-4368af8 call 4368888 1574->1580 1581 4368afd-4368b05 ExitProcess 1574->1581 1575->1568 1580->1581 1581->1568
                                                                                                        APIs
                                                                                                          • Part of subcall function 043687F8: Sleep.KERNELBASE(000001F4), ref: 04368809
                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04368A46
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712385412.0000000004366000.00000040.00000020.00020000.00000000.sdmp, Offset: 04366000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4366000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateFileSleep
                                                                                                        • String ID: GG7KYG5PUUKEU0XFGMBDC
                                                                                                        • API String ID: 2694422964-3537259016
                                                                                                        • Opcode ID: 15d72f22daa463e20e49cdfdf7e77e8cb61326be44cd03d9e03bb177223caba6
                                                                                                        • Instruction ID: 2c98bb8353df809e974edbace1da6cdee0ce8aec905b866b5ce890cf6df44ff0
                                                                                                        • Opcode Fuzzy Hash: 15d72f22daa463e20e49cdfdf7e77e8cb61326be44cd03d9e03bb177223caba6
                                                                                                        • Instruction Fuzzy Hash: E851A470D05289DBEF15DBA4C854BEEBBB8AF19304F005198E649BB2C0D7BA1B44CB65

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 1583 413a88-413a99 call 41718c 1586 413b10-413b15 call 4171d1 1583->1586 1587 413a9b-413aa2 1583->1587 1589 413aa4-413abc call 418407 call 419f6d 1587->1589 1590 413ae7 1587->1590 1600 413ac7-413ad7 call 413ade 1589->1600 1601 413abe-413ac6 call 419f9d 1589->1601 1592 413ae8-413af8 RtlFreeHeap 1590->1592 1592->1586 1595 413afa-413b0f call 417f23 GetLastError call 417ee1 1592->1595 1595->1586 1600->1586 1608 413ad9-413adc 1600->1608 1601->1600 1608->1592
                                                                                                        APIs
                                                                                                        • __lock.LIBCMT ref: 00413AA6
                                                                                                          • Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
                                                                                                          • Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
                                                                                                          • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
                                                                                                        • ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                        • ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                        • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                        • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                        • String ID:
                                                                                                        • API String ID: 2714421763-0
                                                                                                        • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                        • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
                                                                                                        • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                        • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
                                                                                                        APIs
                                                                                                          • Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
                                                                                                          • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
                                                                                                          • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC
                                                                                                        • _strcat.LIBCMT ref: 0040F603
                                                                                                          • Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8
                                                                                                          • Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
                                                                                                        • String ID: HH
                                                                                                        • API String ID: 1194219731-2761332787
                                                                                                        • Opcode ID: 6830d432ce0edc537904fcc81a92ccb4243d6e1eaca554fb6fd30da9042373f9
                                                                                                        • Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
                                                                                                        • Opcode Fuzzy Hash: 6830d432ce0edc537904fcc81a92ccb4243d6e1eaca554fb6fd30da9042373f9
                                                                                                        • Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A
                                                                                                        APIs
                                                                                                        • CreateProcessW.KERNELBASE(?,00000000), ref: 04367FEC
                                                                                                        • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 04368049
                                                                                                        • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0436806B
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712385412.0000000004366000.00000040.00000020.00020000.00000000.sdmp, Offset: 04366000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4366000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                        • String ID:
                                                                                                        • API String ID: 2438371351-0
                                                                                                        • Opcode ID: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
                                                                                                        • Instruction ID: 0df18a25571bf83db0bf1d8519a8dd0c4a82b49f3fb6d8e06e6a831c6b001d9c
                                                                                                        • Opcode Fuzzy Hash: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
                                                                                                        • Instruction Fuzzy Hash: 91621A30A15619DBEB24DFA4C840BDEB376EF58300F10A1A9D10DEB394E775AE81CB59
                                                                                                        APIs
                                                                                                        • _malloc.LIBCMT ref: 00411734
                                                                                                          • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                          • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                          • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                        • std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                          • Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC
                                                                                                        • std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                        • __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                        • String ID:
                                                                                                        • API String ID: 1411284514-0
                                                                                                        • Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                        • Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
                                                                                                        • Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                        • Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                        • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
                                                                                                        • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                        • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
                                                                                                        APIs
                                                                                                        • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
                                                                                                        • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
                                                                                                        • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                        • String ID:
                                                                                                        • API String ID: 3677997916-0
                                                                                                        • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                        • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
                                                                                                        • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                        • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
                                                                                                        APIs
                                                                                                        • _malloc.LIBCMT ref: 00435278
                                                                                                          • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                          • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                          • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                        • _malloc.LIBCMT ref: 00435288
                                                                                                        • _malloc.LIBCMT ref: 00435298
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _malloc$AllocateHeap
                                                                                                        • String ID:
                                                                                                        • API String ID: 680241177-0
                                                                                                        • Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                        • Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
                                                                                                        • Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                        • Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC
                                                                                                        APIs
                                                                                                        • _wcslen.LIBCMT ref: 00401B71
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Exception@8Throw_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                        • String ID: @EXITCODE
                                                                                                        • API String ID: 580348202-3436989551
                                                                                                        • Opcode ID: 48d001a4b96ee351bc7679959485890c1c6d832d60c6cde5ea273d4c8ab31dfe
                                                                                                        • Instruction ID: 288ad252d7dad0c090ff8240dee62855692e698d70424b42c0a66861a7771545
                                                                                                        • Opcode Fuzzy Hash: 48d001a4b96ee351bc7679959485890c1c6d832d60c6cde5ea273d4c8ab31dfe
                                                                                                        • Instruction Fuzzy Hash: 73F06DF2A002025BD7649B35DC0276776E4AB44704F18C83EE14AC7791F6BDE8829B15
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ClearVariant
                                                                                                        • String ID:
                                                                                                        • API String ID: 1473721057-0
                                                                                                        • Opcode ID: e8abe42c1057cb3860218bb04af0a307767d699fcca626a70098e271a71bf477
                                                                                                        • Instruction ID: 1f11e118333250ff1b1cce483c812f274274124743f71e781b8a547d9d3e43da
                                                                                                        • Opcode Fuzzy Hash: e8abe42c1057cb3860218bb04af0a307767d699fcca626a70098e271a71bf477
                                                                                                        • Instruction Fuzzy Hash: 35917E706042009FC714DF55D890A6AB7E5EF89318F14896FF849AB392D738EE41CB9E
                                                                                                        APIs
                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
                                                                                                        • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateFile
                                                                                                        • String ID:
                                                                                                        • API String ID: 823142352-0
                                                                                                        • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                        • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
                                                                                                        • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                        • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __lock_file_memset
                                                                                                        • String ID:
                                                                                                        • API String ID: 26237723-0
                                                                                                        • Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                        • Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
                                                                                                        • Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                        • Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99
                                                                                                        APIs
                                                                                                          • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                          • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                        • __lock_file.LIBCMT ref: 00414EE4
                                                                                                          • Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A
                                                                                                        • __fclose_nolock.LIBCMT ref: 00414EEE
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
                                                                                                        • String ID:
                                                                                                        • API String ID: 717694121-0
                                                                                                        • Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                        • Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
                                                                                                        • Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                        • Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D
                                                                                                        APIs
                                                                                                        • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                        • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Message$DispatchTranslate
                                                                                                        • String ID:
                                                                                                        • API String ID: 1706434739-0
                                                                                                        • Opcode ID: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                        • Instruction ID: 6b3a2aeb923af73eb4cdb1bab797699f2cf27729a5018e8568c19fb4e3feaf67
                                                                                                        • Opcode Fuzzy Hash: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                        • Instruction Fuzzy Hash: D4F05471114301AEDA24DBE58D41B5BB3A8AFD8700F408C2EBA51E61C1FBF8E404C76A
                                                                                                        APIs
                                                                                                        • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                        • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Message$DispatchTranslate
                                                                                                        • String ID:
                                                                                                        • API String ID: 1706434739-0
                                                                                                        • Opcode ID: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                        • Instruction ID: cc4909b6a78c34842ee59a7900970f574117f06624f4f9c7373c79b1fb9dfc76
                                                                                                        • Opcode Fuzzy Hash: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                        • Instruction Fuzzy Hash: DDF054B1114301AADA14DBE58D41B5BB3A4AF94740F408C2EBA11E52C1EBFCD504C71A
                                                                                                        APIs
                                                                                                        • CreateProcessW.KERNELBASE(?,00000000), ref: 04367FEC
                                                                                                        • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 04368049
                                                                                                        • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0436806B
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712385412.0000000004366000.00000040.00000020.00020000.00000000.sdmp, Offset: 04366000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4366000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                        • String ID:
                                                                                                        • API String ID: 2438371351-0
                                                                                                        • Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                                                                        • Instruction ID: 6082dd248ca898322b5e6e6668734384cc909fac15afc04526aaa7f5a7d2e5f1
                                                                                                        • Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                                                                        • Instruction Fuzzy Hash: DD12DF24E14658C6EB24DF64D8507DEB232EF68300F10A4E9910DEB7A4E77A5E81CF5A
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ProtectVirtual
                                                                                                        • String ID:
                                                                                                        • API String ID: 544645111-0
                                                                                                        • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                        • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
                                                                                                        • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                        • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                                                        • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
                                                                                                        • Opcode Fuzzy Hash: a12857963b59ba27d86be744ec8e6ce9272b51880a9e98fb69d1fc4369ccfb77
                                                                                                        • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
                                                                                                        APIs
                                                                                                        • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ProcWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 181713994-0
                                                                                                        • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                        • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
                                                                                                        • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                        • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
                                                                                                        APIs
                                                                                                        • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateHeap
                                                                                                        • String ID:
                                                                                                        • API String ID: 10892065-0
                                                                                                        • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                        • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
                                                                                                        • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                        • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
                                                                                                        APIs
                                                                                                          • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
                                                                                                        • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$PointerWrite
                                                                                                        • String ID:
                                                                                                        • API String ID: 539440098-0
                                                                                                        • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                        • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
                                                                                                        • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                        • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
                                                                                                        APIs
                                                                                                        • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ProcWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 181713994-0
                                                                                                        • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                        • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
                                                                                                        • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                        • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __wfsopen
                                                                                                        • String ID:
                                                                                                        • API String ID: 197181222-0
                                                                                                        • Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                        • Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
                                                                                                        • Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                        • Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589
                                                                                                        APIs
                                                                                                        • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CloseHandle
                                                                                                        • String ID:
                                                                                                        • API String ID: 2962429428-0
                                                                                                        • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                        • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
                                                                                                        • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                        • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
                                                                                                        APIs
                                                                                                        • Sleep.KERNELBASE(000001F4), ref: 04368809
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712385412.0000000004366000.00000040.00000020.00020000.00000000.sdmp, Offset: 04366000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4366000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Sleep
                                                                                                        • String ID:
                                                                                                        • API String ID: 3472027048-0
                                                                                                        • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                        • Instruction ID: 0726e98fa25e47b61b4af7fc106df597b1389943fe4282dcb249f26891cb0fde
                                                                                                        • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                        • Instruction Fuzzy Hash: ACE0E67494110EDFDB00EFB4D54969D7BF4EF04301F104561FD05D2280D6309D508A72
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: PF$PF$"DF$$JG$&F$&F$'HG$'|G$*"D$*nF$*vG$+%F$0wE$4rE$5CG$6MG$6NF$6tE$7eF$<HF$<G$ApG$BnE$DvE$F)G$GSG$IqE$K@G$LbF$MdF$MuE$NgF$O*F$PIF$QbG$R+F$RnG$YlE$YtG$Z9G$ZPG$^[F$^oE$_7G$_?G$b"D$fH$i}G$j)F$kQG$lE$rTG$vjE$}eE$~mE$*F$.F$3G$_G$`F$mE$pE$wG
                                                                                                        • API String ID: 0-4260964411
                                                                                                        • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                        • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
                                                                                                        • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                        • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
                                                                                                        • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
                                                                                                        • GetKeyState.USER32(00000011), ref: 0047C1A4
                                                                                                        • GetKeyState.USER32(00000009), ref: 0047C1AD
                                                                                                        • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
                                                                                                        • GetKeyState.USER32(00000010), ref: 0047C1CA
                                                                                                        • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
                                                                                                        • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
                                                                                                        • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
                                                                                                        • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
                                                                                                        • SendMessageW.USER32 ref: 0047C2FB
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$State$LongProcWindow
                                                                                                        • String ID: @GUI_DRAGID$F
                                                                                                        • API String ID: 1562745308-4164748364
                                                                                                        • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                        • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
                                                                                                        • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                        • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
                                                                                                        APIs
                                                                                                        • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
                                                                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
                                                                                                        • IsIconic.USER32(?), ref: 004375E1
                                                                                                        • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
                                                                                                        • SetForegroundWindow.USER32(?), ref: 004375FD
                                                                                                        • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00437619
                                                                                                        • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
                                                                                                        • SetForegroundWindow.USER32(?), ref: 00437645
                                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
                                                                                                        • keybd_event.USER32(00000012,00000000), ref: 0043765D
                                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
                                                                                                        • keybd_event.USER32(00000012,00000000), ref: 00437674
                                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
                                                                                                        • keybd_event.USER32(00000012,00000000), ref: 0043768B
                                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
                                                                                                        • keybd_event.USER32(00000012,00000000), ref: 004376A2
                                                                                                        • SetForegroundWindow.USER32(?), ref: 004376AD
                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                        • String ID: Shell_TrayWnd
                                                                                                        • API String ID: 3778422247-2988720461
                                                                                                        • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                        • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
                                                                                                        • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                        • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 0044621B
                                                                                                        • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
                                                                                                        • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
                                                                                                        • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
                                                                                                        • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
                                                                                                        • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
                                                                                                        • _wcslen.LIBCMT ref: 0044639E
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                        • _wcsncpy.LIBCMT ref: 004463C7
                                                                                                        • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
                                                                                                        • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
                                                                                                        • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
                                                                                                        • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
                                                                                                        • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
                                                                                                        • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
                                                                                                        • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
                                                                                                        • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
                                                                                                        • String ID: $default$winsta0
                                                                                                        • API String ID: 2173856841-1027155976
                                                                                                        • Opcode ID: 8783c105518f9fa52f5c80a6299cf7ec7b6e28c011eada52347f54b488ad9e21
                                                                                                        • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
                                                                                                        • Opcode Fuzzy Hash: 8783c105518f9fa52f5c80a6299cf7ec7b6e28c011eada52347f54b488ad9e21
                                                                                                        • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
                                                                                                        APIs
                                                                                                          • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\fAzUnj6Djg.exe,?,C:\Users\user\Desktop\fAzUnj6Djg.exe,004A8E80,C:\Users\user\Desktop\fAzUnj6Djg.exe,0040F3D2), ref: 0040FFCA
                                                                                                          • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A45
                                                                                                          • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                          • Part of subcall function 00436A1D: __wcsicoll.LIBCMT ref: 00436A93
                                                                                                          • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                        • _wcscat.LIBCMT ref: 0044BD96
                                                                                                        • _wcscat.LIBCMT ref: 0044BDBF
                                                                                                        • __wsplitpath.LIBCMT ref: 0044BDEC
                                                                                                        • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                                                                                                        • _wcscpy.LIBCMT ref: 0044BE73
                                                                                                        • _wcscat.LIBCMT ref: 0044BE85
                                                                                                        • _wcscat.LIBCMT ref: 0044BE97
                                                                                                        • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                                                                                                        • DeleteFileW.KERNEL32(?), ref: 0044BED5
                                                                                                        • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                                                                                                        • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
                                                                                                        • DeleteFileW.KERNEL32(?), ref: 0044BF17
                                                                                                        • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
                                                                                                        • FindClose.KERNEL32(00000000), ref: 0044BF35
                                                                                                        • MoveFileW.KERNEL32(?,?), ref: 0044BF51
                                                                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
                                                                                                        • FindClose.KERNEL32(00000000), ref: 0044BF7E
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
                                                                                                        • String ID: \*.*
                                                                                                        • API String ID: 2188072990-1173974218
                                                                                                        • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                        • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
                                                                                                        • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                        • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
                                                                                                        APIs
                                                                                                        • __invoke_watson.LIBCMT ref: 004203A4
                                                                                                          • Part of subcall function 00417D93: _memset.LIBCMT ref: 00417DBB
                                                                                                          • Part of subcall function 00417D93: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
                                                                                                          • Part of subcall function 00417D93: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
                                                                                                          • Part of subcall function 00417D93: UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
                                                                                                          • Part of subcall function 00417D93: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
                                                                                                          • Part of subcall function 00417D93: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
                                                                                                        • __get_daylight.LIBCMT ref: 004203B0
                                                                                                        • __invoke_watson.LIBCMT ref: 004203BF
                                                                                                        • __get_daylight.LIBCMT ref: 004203CB
                                                                                                        • __invoke_watson.LIBCMT ref: 004203DA
                                                                                                        • ____lc_codepage_func.LIBCMT ref: 004203E2
                                                                                                        • _strlen.LIBCMT ref: 00420442
                                                                                                        • __malloc_crt.LIBCMT ref: 00420449
                                                                                                        • _strlen.LIBCMT ref: 0042045F
                                                                                                        • _strcpy_s.LIBCMT ref: 0042046D
                                                                                                        • __invoke_watson.LIBCMT ref: 00420482
                                                                                                        • GetTimeZoneInformation.KERNEL32(00496C28), ref: 004204AA
                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,00496C2C,?,?,0000003F,?,?), ref: 00420528
                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,00496C80,000000FF,?,0000003F,?,?,?,00496C2C,?,?,0000003F,?,?), ref: 0042055C
                                                                                                          • Part of subcall function 00413A88: __lock.LIBCMT ref: 00413AA6
                                                                                                          • Part of subcall function 00413A88: ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                          • Part of subcall function 00413A88: ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                          • Part of subcall function 00413A88: RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                          • Part of subcall function 00413A88: GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                        • __invoke_watson.LIBCMT ref: 004205CC
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __invoke_watson$ByteCharExceptionFilterMultiProcessUnhandledWide__get_daylight_strlen$CurrentDebuggerErrorFreeHeapInformationLastPresentTerminateTimeZone____lc_codepage_func___sbh_find_block___sbh_free_block__lock__malloc_crt_memset_strcpy_s
                                                                                                        • String ID: S\
                                                                                                        • API String ID: 4084823496-393906132
                                                                                                        • Opcode ID: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                                        • Instruction ID: b357f19af7064e56bcdb8625987f67de7edc2332d57e558cb2e7b84f91b73af7
                                                                                                        • Opcode Fuzzy Hash: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                                        • Instruction Fuzzy Hash: 6A91D371E00125AFDB20EF65EC819AE7BE9EF55300B95003BF540A7253DA3C89828F5C
                                                                                                        APIs
                                                                                                        • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
                                                                                                        • __swprintf.LIBCMT ref: 00434D91
                                                                                                        • _wcslen.LIBCMT ref: 00434D9B
                                                                                                        • _wcslen.LIBCMT ref: 00434DB0
                                                                                                        • _wcslen.LIBCMT ref: 00434DC5
                                                                                                        • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
                                                                                                        • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
                                                                                                        • _memset.LIBCMT ref: 00434E27
                                                                                                        • _wcslen.LIBCMT ref: 00434E3C
                                                                                                        • _wcsncpy.LIBCMT ref: 00434E6F
                                                                                                        • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00434EB4
                                                                                                        • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00434ECE
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcslen$CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                                                        • String ID: :$\$\??\%s
                                                                                                        • API String ID: 302090198-3457252023
                                                                                                        • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                        • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
                                                                                                        • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                        • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
                                                                                                        APIs
                                                                                                          • Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E
                                                                                                        • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
                                                                                                        • GetLastError.KERNEL32 ref: 004644B4
                                                                                                        • GetCurrentThread.KERNEL32 ref: 004644C8
                                                                                                        • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
                                                                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
                                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
                                                                                                        • String ID: SeDebugPrivilege
                                                                                                        • API String ID: 1312810259-2896544425
                                                                                                        • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                        • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
                                                                                                        • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                        • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
                                                                                                        APIs
                                                                                                        • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                                                                                                          • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\fAzUnj6Djg.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                                                                                                          • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
                                                                                                          • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
                                                                                                          • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
                                                                                                          • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
                                                                                                          • Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF
                                                                                                        • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
                                                                                                        • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\fAzUnj6Djg.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                                                                                                          • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\fAzUnj6Djg.exe,00000004), ref: 0040D7D6
                                                                                                        • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\fAzUnj6Djg.exe,00000004), ref: 00431B0E
                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\fAzUnj6Djg.exe,00000004), ref: 00431B3F
                                                                                                        • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
                                                                                                        • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                                                                                                          • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                          • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                          • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                          • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                          • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                          • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                          • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                                                                                                          • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                          • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                          • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                          • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                          • Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
                                                                                                          • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
                                                                                                        • String ID: @GH$@GH$C:\Users\user\Desktop\fAzUnj6Djg.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                                                                                                        • API String ID: 2493088469-1053633497
                                                                                                        • Opcode ID: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                                        • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
                                                                                                        • Opcode Fuzzy Hash: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                                        • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E
                                                                                                        APIs
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
                                                                                                        • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
                                                                                                        • __wsplitpath.LIBCMT ref: 004038B2
                                                                                                          • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                        • _wcscpy.LIBCMT ref: 004038C7
                                                                                                        • _wcscat.LIBCMT ref: 004038DC
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                          • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                                                                                                          • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
                                                                                                        • _wcscpy.LIBCMT ref: 004039C2
                                                                                                        • _wcslen.LIBCMT ref: 00403A53
                                                                                                        • _wcslen.LIBCMT ref: 00403AAA
                                                                                                        Strings
                                                                                                        • _, xrefs: 00403B48
                                                                                                        • Unterminated string, xrefs: 0042B9BA
                                                                                                        • Error opening the file, xrefs: 0042B8AC
                                                                                                        • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpy$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_wcscatstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                        • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                                                                                                        • API String ID: 4115725249-188983378
                                                                                                        • Opcode ID: e410348e96554644cb024ebf95e8b2d2088fffc0e8404256067a24ee959a0054
                                                                                                        • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
                                                                                                        • Opcode Fuzzy Hash: e410348e96554644cb024ebf95e8b2d2088fffc0e8404256067a24ee959a0054
                                                                                                        • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
                                                                                                        APIs
                                                                                                        • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
                                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
                                                                                                        • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
                                                                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
                                                                                                        • FindClose.KERNEL32(00000000), ref: 00434C88
                                                                                                        • FindClose.KERNEL32(00000000), ref: 00434C9C
                                                                                                        • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
                                                                                                        • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
                                                                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
                                                                                                        • FindClose.KERNEL32(00000000), ref: 00434D35
                                                                                                        • FindClose.KERNEL32(00000000), ref: 00434D43
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                                        • String ID: *.*
                                                                                                        • API String ID: 1409584000-438819550
                                                                                                        • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                        • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
                                                                                                        • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                        • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Timetime$Sleep
                                                                                                        • String ID: BUTTON
                                                                                                        • API String ID: 4176159691-3405671355
                                                                                                        • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                        • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
                                                                                                        • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                        • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
                                                                                                        APIs
                                                                                                        • FindFirstFileW.KERNEL32(?,74DE8FB0,74DE8FB0,?,?,00000000), ref: 00442E40
                                                                                                        • FindNextFileW.KERNEL32(00000000,?,?,00000000), ref: 00442EA4
                                                                                                        • FindClose.KERNEL32(00000000,?,00000000), ref: 00442EB5
                                                                                                        • FindClose.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00442ED1
                                                                                                        • FindFirstFileW.KERNEL32(*.*,?), ref: 00442EF0
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00442F3B
                                                                                                        • SetCurrentDirectoryW.KERNEL32(0048A090,?,?,?,00000000), ref: 00442F6D
                                                                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 00442F75
                                                                                                        • FindClose.KERNEL32(00000000), ref: 00442F80
                                                                                                          • Part of subcall function 00436D2D: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,74DF3220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                                                        • FindClose.KERNEL32(00000000,?,?,?,00000000), ref: 00442F92
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                                                                        • String ID: *.*
                                                                                                        • API String ID: 2640511053-438819550
                                                                                                        • Opcode ID: 9379a40a392f11a7e453a238fddec55769e51d026bd73d4c4d0da232c8837110
                                                                                                        • Instruction ID: 5fd3b3f399b1dfd6b0a62b5043663bf11a2259675d3c80dc16c90576bc2ddb84
                                                                                                        • Opcode Fuzzy Hash: 9379a40a392f11a7e453a238fddec55769e51d026bd73d4c4d0da232c8837110
                                                                                                        • Instruction Fuzzy Hash: 0F41E8326083046BD620FA64DD85BEFB3A89BC5311F54492FF95483280E7FEA50D8779
                                                                                                        APIs
                                                                                                          • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                                                                                                          • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                                                                                                          • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                                                                                                          • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
                                                                                                        • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
                                                                                                        • _memset.LIBCMT ref: 00445E61
                                                                                                        • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
                                                                                                        • GetLengthSid.ADVAPI32(?), ref: 00445E92
                                                                                                        • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
                                                                                                        • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
                                                                                                        • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
                                                                                                        • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
                                                                                                        • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
                                                                                                        • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
                                                                                                        • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
                                                                                                        • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                                        • String ID:
                                                                                                        • API String ID: 3490752873-0
                                                                                                        • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                        • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
                                                                                                        • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                        • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
                                                                                                        APIs
                                                                                                        • OleInitialize.OLE32(00000000), ref: 0047AA03
                                                                                                        • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
                                                                                                        • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
                                                                                                        • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
                                                                                                        • _memset.LIBCMT ref: 0047AB7C
                                                                                                        • _wcslen.LIBCMT ref: 0047AC68
                                                                                                        • _memset.LIBCMT ref: 0047ACCD
                                                                                                        • CoCreateInstanceEx.OLE32 ref: 0047AD06
                                                                                                        • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
                                                                                                        Strings
                                                                                                        • NULL Pointer assignment, xrefs: 0047AD84
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
                                                                                                        • String ID: NULL Pointer assignment
                                                                                                        • API String ID: 1588287285-2785691316
                                                                                                        • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                        • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
                                                                                                        • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                        • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
                                                                                                        APIs
                                                                                                        • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
                                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
                                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
                                                                                                        • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
                                                                                                        • GetLastError.KERNEL32 ref: 00436504
                                                                                                        • ExitWindowsEx.USER32(?,00000000), ref: 00436527
                                                                                                        • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
                                                                                                        • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                                                                                                        • String ID: SeShutdownPrivilege
                                                                                                        • API String ID: 2938487562-3733053543
                                                                                                        • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                        • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
                                                                                                        • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                        • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
                                                                                                        APIs
                                                                                                        • __swprintf.LIBCMT ref: 00436162
                                                                                                        • __swprintf.LIBCMT ref: 00436176
                                                                                                          • Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F
                                                                                                        • __wcsicoll.LIBCMT ref: 00436185
                                                                                                        • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
                                                                                                        • LoadResource.KERNEL32(?,00000000), ref: 004361AE
                                                                                                        • LockResource.KERNEL32(00000000), ref: 004361B5
                                                                                                        • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
                                                                                                        • LoadResource.KERNEL32(?,00000000), ref: 004361E4
                                                                                                        • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
                                                                                                        • LockResource.KERNEL32(?), ref: 004361FD
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
                                                                                                        • String ID:
                                                                                                        • API String ID: 2406429042-0
                                                                                                        • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                        • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
                                                                                                        • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                        • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
                                                                                                        APIs
                                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D522
                                                                                                        • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
                                                                                                        • GetLastError.KERNEL32 ref: 0045D59D
                                                                                                        • SetErrorMode.KERNEL32(?), ref: 0045D629
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                        • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                        • API String ID: 4194297153-14809454
                                                                                                        • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                        • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
                                                                                                        • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                        • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
                                                                                                        APIs
                                                                                                        • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                                                                                                          • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                        • OleInitialize.OLE32(00000000), ref: 0047AE06
                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                        • _wcslen.LIBCMT ref: 0047AE18
                                                                                                        • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
                                                                                                        • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
                                                                                                        • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CopyVariant$_wcslen$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg_wcscpy
                                                                                                        • String ID: HH
                                                                                                        • API String ID: 1915432386-2761332787
                                                                                                        • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                        • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
                                                                                                        • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                        • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: DEFINE$`$h$h
                                                                                                        • API String ID: 0-4194577831
                                                                                                        • Opcode ID: 53b7279d5b659778b651e94439d899c69cc4b33ac19e6b5c077e56500386ae31
                                                                                                        • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
                                                                                                        • Opcode Fuzzy Hash: 53b7279d5b659778b651e94439d899c69cc4b33ac19e6b5c077e56500386ae31
                                                                                                        • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
                                                                                                        APIs
                                                                                                        • socket.WSOCK32(00000002,00000001,00000006,?,00000000), ref: 004648B0
                                                                                                        • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
                                                                                                        • bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648DA
                                                                                                        • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
                                                                                                        • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000005,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 0046492D
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorLast$bindclosesocketsocket
                                                                                                        • String ID:
                                                                                                        • API String ID: 2609815416-0
                                                                                                        • Opcode ID: c745fc0386eefc9461b0625fcf5f9e880147eba2f1499b917674c09f315cfe6e
                                                                                                        • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
                                                                                                        • Opcode Fuzzy Hash: c745fc0386eefc9461b0625fcf5f9e880147eba2f1499b917674c09f315cfe6e
                                                                                                        • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
                                                                                                        APIs
                                                                                                        • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
                                                                                                        • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
                                                                                                        • Process32NextW.KERNEL32(00000000,?), ref: 00437075
                                                                                                        • __wsplitpath.LIBCMT ref: 004370A5
                                                                                                          • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                        • _wcscat.LIBCMT ref: 004370BA
                                                                                                        • __wcsicoll.LIBCMT ref: 004370C8
                                                                                                        • CloseHandle.KERNEL32(00000000,?), ref: 00437105
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                        • String ID:
                                                                                                        • API String ID: 2547909840-0
                                                                                                        • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                        • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
                                                                                                        • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                        • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
                                                                                                        APIs
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
                                                                                                        • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
                                                                                                        • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
                                                                                                        • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Find$File$CloseFirstNextSleep_wcslen
                                                                                                        • String ID: *.*
                                                                                                        • API String ID: 2693929171-438819550
                                                                                                        • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                        • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
                                                                                                        • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                        • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
                                                                                                        APIs
                                                                                                        • __wcsicoll.LIBCMT ref: 0043643C
                                                                                                        • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
                                                                                                        • __wcsicoll.LIBCMT ref: 00436466
                                                                                                        • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __wcsicollmouse_event
                                                                                                        • String ID: DOWN
                                                                                                        • API String ID: 1033544147-711622031
                                                                                                        • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                        • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
                                                                                                        • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                        • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
                                                                                                        APIs
                                                                                                          • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                        • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
                                                                                                        • WSAGetLastError.WSOCK32(00000000), ref: 00474233
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorLastinet_addrsocket
                                                                                                        • String ID:
                                                                                                        • API String ID: 4170576061-0
                                                                                                        • Opcode ID: cabea8b38002fa781011b5f0595ab941099387897a9684b67fae1790c0a48004
                                                                                                        • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
                                                                                                        • Opcode Fuzzy Hash: cabea8b38002fa781011b5f0595ab941099387897a9684b67fae1790c0a48004
                                                                                                        • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
                                                                                                        APIs
                                                                                                        • GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                        • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                        • GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                        • GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00456430
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AsyncState$ClientCursorLongScreenWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 3539004672-0
                                                                                                        • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                        • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
                                                                                                        • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                        • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
                                                                                                        APIs
                                                                                                          • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                        • IsWindowVisible.USER32 ref: 00477314
                                                                                                        • IsWindowEnabled.USER32 ref: 00477324
                                                                                                        • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
                                                                                                        • IsIconic.USER32 ref: 0047733F
                                                                                                        • IsZoomed.USER32 ref: 0047734D
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                                        • String ID:
                                                                                                        • API String ID: 292994002-0
                                                                                                        • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                        • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
                                                                                                        • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                        • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
                                                                                                        APIs
                                                                                                        • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,74DF3220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                                                        • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$CloseCreateHandleTime
                                                                                                        • String ID:
                                                                                                        • API String ID: 3397143404-0
                                                                                                        • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                        • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
                                                                                                        • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                        • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _strncmp
                                                                                                        • String ID: ACCEPT$^$h
                                                                                                        • API String ID: 909875538-4263704089
                                                                                                        • Opcode ID: a6541d7913cd7701a75e3a8dc778404717b64597fc065691f0327c8a2e2ba149
                                                                                                        • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
                                                                                                        • Opcode Fuzzy Hash: a6541d7913cd7701a75e3a8dc778404717b64597fc065691f0327c8a2e2ba149
                                                                                                        • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
                                                                                                        APIs
                                                                                                        • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
                                                                                                        • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
                                                                                                        • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Find$File$CloseFirstNext
                                                                                                        • String ID:
                                                                                                        • API String ID: 3541575487-0
                                                                                                        • Opcode ID: 14602e3ddb85434cb4a191148b4ac58dc13c9e22f939418703ff5d8e88b69fcb
                                                                                                        • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
                                                                                                        • Opcode Fuzzy Hash: 14602e3ddb85434cb4a191148b4ac58dc13c9e22f939418703ff5d8e88b69fcb
                                                                                                        • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
                                                                                                        APIs
                                                                                                        • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
                                                                                                        • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
                                                                                                        • FindClose.KERNEL32(00000000), ref: 00436B13
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: FileFind$AttributesCloseFirst
                                                                                                        • String ID:
                                                                                                        • API String ID: 48322524-0
                                                                                                        • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                        • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
                                                                                                        • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                        • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
                                                                                                        APIs
                                                                                                        • __time64.LIBCMT ref: 004433A2
                                                                                                          • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                          • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Time$FileSystem__aulldiv__time64
                                                                                                        • String ID: rJ
                                                                                                        • API String ID: 2893107130-1865492326
                                                                                                        • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                        • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
                                                                                                        • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                        • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
                                                                                                        APIs
                                                                                                        • __time64.LIBCMT ref: 004433A2
                                                                                                          • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                          • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Time$FileSystem__aulldiv__time64
                                                                                                        • String ID: rJ
                                                                                                        • API String ID: 2893107130-1865492326
                                                                                                        • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                        • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
                                                                                                        • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                        • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
                                                                                                        APIs
                                                                                                        • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
                                                                                                        • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                                                                                                          • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Internet$AvailableDataErrorFileLastQueryRead
                                                                                                        • String ID:
                                                                                                        • API String ID: 901099227-0
                                                                                                        • Opcode ID: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                                                        • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
                                                                                                        • Opcode Fuzzy Hash: 0771251b70b9bd68c35fac6f7da5b5f16004994504cb59d35d549d3fc14a9ba4
                                                                                                        • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
                                                                                                        APIs
                                                                                                        • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
                                                                                                        • FindClose.KERNEL32(00000000), ref: 0045DDDD
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                        • String ID:
                                                                                                        • API String ID: 2295610775-0
                                                                                                        • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                        • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
                                                                                                        • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                        • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 0vH$HH
                                                                                                        • API String ID: 0-728391547
                                                                                                        • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                        • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
                                                                                                        • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                        • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _memset
                                                                                                        • String ID:
                                                                                                        • API String ID: 2102423945-0
                                                                                                        • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                        • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
                                                                                                        • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                        • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
                                                                                                        APIs
                                                                                                        • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Proc
                                                                                                        • String ID:
                                                                                                        • API String ID: 2346855178-0
                                                                                                        • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                        • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
                                                                                                        • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                        • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
                                                                                                        APIs
                                                                                                        • BlockInput.USER32(00000001), ref: 0045A272
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: BlockInput
                                                                                                        • String ID:
                                                                                                        • API String ID: 3456056419-0
                                                                                                        • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                        • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
                                                                                                        • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                        • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
                                                                                                        APIs
                                                                                                        • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: LogonUser
                                                                                                        • String ID:
                                                                                                        • API String ID: 1244722697-0
                                                                                                        • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                        • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
                                                                                                        • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                        • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: NameUser
                                                                                                        • String ID:
                                                                                                        • API String ID: 2645101109-0
                                                                                                        • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                        • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
                                                                                                        • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                        • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
                                                                                                        APIs
                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ExceptionFilterUnhandled
                                                                                                        • String ID:
                                                                                                        • API String ID: 3192549508-0
                                                                                                        • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                        • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
                                                                                                        • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                        • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                        • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
                                                                                                        • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                        • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                        • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
                                                                                                        • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                        • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                        • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
                                                                                                        • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                        • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                        • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
                                                                                                        • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                        • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712385412.0000000004366000.00000040.00000020.00020000.00000000.sdmp, Offset: 04366000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4366000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                                        • Instruction ID: 7f0160fe75c8ea20fd49b900f06d8c695fe452948702280d065fb0a92612e86b
                                                                                                        • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                                                                        • Instruction Fuzzy Hash: 7F41D5B1D1051CDBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB80
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712385412.0000000004366000.00000040.00000020.00020000.00000000.sdmp, Offset: 04366000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4366000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                                        • Instruction ID: 37fb6f51affe05d12fbbeb97c3ecafb62f2d18bee9fbd6756ac7c0c8c8b530ea
                                                                                                        • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                                                                        • Instruction Fuzzy Hash: 7D018078A00209EFCB44DF98C5909AEF7F5FF48210F208599D81AA7705E730AE41DB80
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712385412.0000000004366000.00000040.00000020.00020000.00000000.sdmp, Offset: 04366000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4366000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                                        • Instruction ID: 0cf6921422ee36a69fa43de6a353fdbdb2908a3ffd933f1e82f02ddac7d82186
                                                                                                        • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                                                                        • Instruction Fuzzy Hash: E20192B8A10209EFCB44DF98C5909AEF7F5FF48310F208599D81AA7705E730AE41DB80
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                        • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
                                                                                                        • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                        • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1712385412.0000000004366000.00000040.00000020.00020000.00000000.sdmp, Offset: 04366000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_4366000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                                        • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                                                                                        • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                                                                        • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                                                                                        APIs
                                                                                                        • DeleteObject.GDI32(?), ref: 004593D7
                                                                                                        • DeleteObject.GDI32(?), ref: 004593F1
                                                                                                        • DestroyWindow.USER32(?), ref: 00459407
                                                                                                        • GetDesktopWindow.USER32 ref: 0045942A
                                                                                                        • GetWindowRect.USER32(00000000), ref: 00459431
                                                                                                        • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
                                                                                                        • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
                                                                                                        • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
                                                                                                        • GetClientRect.USER32(00000000,?), ref: 004595C8
                                                                                                        • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
                                                                                                        • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
                                                                                                        • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 00459668
                                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
                                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
                                                                                                        • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
                                                                                                        • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
                                                                                                        • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 004596C0
                                                                                                        • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
                                                                                                        • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
                                                                                                        • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
                                                                                                        • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
                                                                                                        • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
                                                                                                        • GetStockObject.GDI32(00000011), ref: 004597B7
                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 004597BF
                                                                                                        • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
                                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
                                                                                                        • DeleteDC.GDI32(00000000), ref: 004597E1
                                                                                                        • _wcslen.LIBCMT ref: 00459800
                                                                                                        • _wcscpy.LIBCMT ref: 0045981F
                                                                                                        • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
                                                                                                        • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
                                                                                                        • GetDC.USER32(?), ref: 004598DE
                                                                                                        • SelectObject.GDI32(00000000,?), ref: 004598EE
                                                                                                        • SelectObject.GDI32(00000000,?), ref: 00459919
                                                                                                        • ReleaseDC.USER32(?,00000000), ref: 00459925
                                                                                                        • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
                                                                                                        • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
                                                                                                        • String ID: $AutoIt v3$DISPLAY$static
                                                                                                        • API String ID: 4040870279-2373415609
                                                                                                        • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                        • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
                                                                                                        • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                        • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
                                                                                                        APIs
                                                                                                        • GetSysColor.USER32(00000012), ref: 00441E64
                                                                                                        • SetTextColor.GDI32(?,?), ref: 00441E6C
                                                                                                        • GetSysColorBrush.USER32(0000000F), ref: 00441E83
                                                                                                        • GetSysColor.USER32(0000000F), ref: 00441E8F
                                                                                                        • SetBkColor.GDI32(?,?), ref: 00441EAA
                                                                                                        • SelectObject.GDI32(?,?), ref: 00441EBA
                                                                                                        • InflateRect.USER32(?,000000FF,000000FF), ref: 00441EF0
                                                                                                        • GetSysColor.USER32(00000010), ref: 00441EF8
                                                                                                        • CreateSolidBrush.GDI32(00000000), ref: 00441EFF
                                                                                                        • FrameRect.USER32(?,?,00000000), ref: 00441F10
                                                                                                        • DeleteObject.GDI32(?), ref: 00441F1B
                                                                                                        • InflateRect.USER32(?,000000FE,000000FE), ref: 00441F75
                                                                                                        • FillRect.USER32(?,?,?), ref: 00441FB6
                                                                                                          • Part of subcall function 00433D5C: GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                                          • Part of subcall function 00433D5C: SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                                          • Part of subcall function 00433D5C: GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                                          • Part of subcall function 00433D5C: GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                                          • Part of subcall function 00433D5C: GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                                          • Part of subcall function 00433D5C: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                                          • Part of subcall function 00433D5C: SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                                          • Part of subcall function 00433D5C: SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                                          • Part of subcall function 00433D5C: SelectObject.GDI32(?,?), ref: 00433E29
                                                                                                          • Part of subcall function 00433D5C: InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                                          • Part of subcall function 00433D5C: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                                          • Part of subcall function 00433D5C: GetWindowLongW.USER32 ref: 00433E8A
                                                                                                          • Part of subcall function 00433D5C: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Color$Rect$Object$BrushInflateSelect$CreateText$DeleteFillFrameLongMessageRoundSendSolidWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 69173610-0
                                                                                                        • Opcode ID: 930605f3cd1c335a452d6420eef3f3c10f8d3d9e6664604232036969332d5250
                                                                                                        • Instruction ID: 0b0c06e318eae1aa70623bc76f746578ebcda4f465cb69034399d4c57c44293d
                                                                                                        • Opcode Fuzzy Hash: 930605f3cd1c335a452d6420eef3f3c10f8d3d9e6664604232036969332d5250
                                                                                                        • Instruction Fuzzy Hash: BBB14D71508300AFD314DF64DD88A6FB7F8FB88720F504A2DF996922A0D774E845CB66
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __wcsnicmp
                                                                                                        • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
                                                                                                        • API String ID: 1038674560-3360698832
                                                                                                        • Opcode ID: 87a66eadcaf8420a9e8e1157d1f7c7fd58aef90dc088af7a86e197dee8fb1ec4
                                                                                                        • Instruction ID: b6083b7aed1673b33e689ff2aa7e8f17f47d7310e90ec65f4167159f85ee96f3
                                                                                                        • Opcode Fuzzy Hash: 87a66eadcaf8420a9e8e1157d1f7c7fd58aef90dc088af7a86e197dee8fb1ec4
                                                                                                        • Instruction Fuzzy Hash: 5A611471B4071076EA306A229C46FAB735CDF14345F50052FFC01A628BE7ADDA4A86EE
                                                                                                        APIs
                                                                                                        • GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                                        • GetSysColor.USER32(00000012), ref: 00433DA3
                                                                                                        • SetTextColor.GDI32(?,?), ref: 00433DAB
                                                                                                        • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                                        • GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                                        • CreateSolidBrush.GDI32(?), ref: 00433DD4
                                                                                                        • GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                                        • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                                        • SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                                        • SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                                        • SelectObject.GDI32(?,?), ref: 00433E29
                                                                                                        • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                                        • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                                        • GetWindowLongW.USER32 ref: 00433E8A
                                                                                                        • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                                        • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
                                                                                                        • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
                                                                                                        • DrawFocusRect.USER32(?,?), ref: 00433F1F
                                                                                                        • GetSysColor.USER32(00000011), ref: 00433F2E
                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 00433F36
                                                                                                        • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
                                                                                                        • SelectObject.GDI32(?,?), ref: 00433F63
                                                                                                        • DeleteObject.GDI32(?), ref: 00433F70
                                                                                                        • SelectObject.GDI32(?,?), ref: 00433F78
                                                                                                        • DeleteObject.GDI32(00000000), ref: 00433F7B
                                                                                                        • SetTextColor.GDI32(?,?), ref: 00433F83
                                                                                                        • SetBkColor.GDI32(?,?), ref: 00433F8F
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                        • String ID:
                                                                                                        • API String ID: 1582027408-0
                                                                                                        • Opcode ID: 697ef1e2b469c7a94178de5208286552364449c38c8500f3df1fcdb24db8d4eb
                                                                                                        • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
                                                                                                        • Opcode Fuzzy Hash: 697ef1e2b469c7a94178de5208286552364449c38c8500f3df1fcdb24db8d4eb
                                                                                                        • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
                                                                                                        APIs
                                                                                                        • GetCursorPos.USER32(?), ref: 00456692
                                                                                                        • GetDesktopWindow.USER32 ref: 004566AA
                                                                                                        • GetWindowRect.USER32(00000000), ref: 004566B1
                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00456720
                                                                                                        • DestroyWindow.USER32(?), ref: 00456731
                                                                                                        • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
                                                                                                        • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
                                                                                                        • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
                                                                                                        • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
                                                                                                        • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
                                                                                                        • IsWindowVisible.USER32(?), ref: 00456812
                                                                                                        • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
                                                                                                        • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
                                                                                                        • GetWindowRect.USER32(?,?), ref: 0045685C
                                                                                                        • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
                                                                                                        • GetMonitorInfoW.USER32 ref: 00456894
                                                                                                        • CopyRect.USER32(?,?), ref: 004568A8
                                                                                                        • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
                                                                                                        • String ID: ($,$tooltips_class32
                                                                                                        • API String ID: 541082891-3320066284
                                                                                                        • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                        • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
                                                                                                        • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                        • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
                                                                                                        APIs
                                                                                                        • _wcslen.LIBCMT ref: 00454DCF
                                                                                                        • _wcslen.LIBCMT ref: 00454DE2
                                                                                                        • __wcsicoll.LIBCMT ref: 00454DEF
                                                                                                        • _wcslen.LIBCMT ref: 00454E04
                                                                                                        • __wcsicoll.LIBCMT ref: 00454E11
                                                                                                        • _wcslen.LIBCMT ref: 00454E24
                                                                                                        • __wcsicoll.LIBCMT ref: 00454E31
                                                                                                          • Part of subcall function 004115D0: __wcsicmp_l.LIBCMT ref: 00411657
                                                                                                        • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
                                                                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
                                                                                                        • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
                                                                                                        • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
                                                                                                        • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
                                                                                                        • FreeLibrary.KERNEL32(00000000), ref: 00454F37
                                                                                                        • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
                                                                                                        • DestroyIcon.USER32(?), ref: 00454FA2
                                                                                                        • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
                                                                                                        • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
                                                                                                        • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Load$Image_wcslen$__wcsicoll$IconLibraryMessageSend$DestroyExtractFreeMoveWindow__wcsicmp_l
                                                                                                        • String ID: .dll$.exe$.icl
                                                                                                        • API String ID: 2511167534-1154884017
                                                                                                        • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                        • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
                                                                                                        • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                        • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
                                                                                                        APIs
                                                                                                        • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
                                                                                                        • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
                                                                                                        • _wcslen.LIBCMT ref: 00436B79
                                                                                                        • _wcscpy.LIBCMT ref: 00436B9F
                                                                                                        • _wcscat.LIBCMT ref: 00436BC0
                                                                                                        • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
                                                                                                        • _wcscat.LIBCMT ref: 00436C2A
                                                                                                        • _wcscat.LIBCMT ref: 00436C31
                                                                                                        • __wcsicoll.LIBCMT ref: 00436C4B
                                                                                                        • _wcsncpy.LIBCMT ref: 00436C62
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
                                                                                                        • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                        • API String ID: 1503153545-1459072770
                                                                                                        • Opcode ID: 4bf5914395717010b0ea9e2d69638f6034391d2624482ee6cf2f9dbb9f61e865
                                                                                                        • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
                                                                                                        • Opcode Fuzzy Hash: 4bf5914395717010b0ea9e2d69638f6034391d2624482ee6cf2f9dbb9f61e865
                                                                                                        • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
                                                                                                        APIs
                                                                                                          • Part of subcall function 004431E0: __time64.LIBCMT ref: 004431EA
                                                                                                        • _fseek.LIBCMT ref: 004527FC
                                                                                                        • __wsplitpath.LIBCMT ref: 0045285C
                                                                                                        • _wcscpy.LIBCMT ref: 00452871
                                                                                                        • _wcscat.LIBCMT ref: 00452886
                                                                                                        • __wsplitpath.LIBCMT ref: 004528B0
                                                                                                        • _wcscat.LIBCMT ref: 004528C8
                                                                                                        • _wcscat.LIBCMT ref: 004528DD
                                                                                                        • __fread_nolock.LIBCMT ref: 00452914
                                                                                                        • __fread_nolock.LIBCMT ref: 00452925
                                                                                                        • __fread_nolock.LIBCMT ref: 00452944
                                                                                                        • __fread_nolock.LIBCMT ref: 00452955
                                                                                                        • __fread_nolock.LIBCMT ref: 00452976
                                                                                                        • __fread_nolock.LIBCMT ref: 00452987
                                                                                                        • __fread_nolock.LIBCMT ref: 00452998
                                                                                                        • __fread_nolock.LIBCMT ref: 004529A9
                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                          • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                          • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                          • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                        • __fread_nolock.LIBCMT ref: 00452A39
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
                                                                                                        • String ID:
                                                                                                        • API String ID: 2054058615-0
                                                                                                        • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                        • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
                                                                                                        • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                        • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 0-4108050209
                                                                                                        • Opcode ID: 832d7dfe82571d46151d64c4ba74b7ae12496bc5cddea04242c0c379dd164914
                                                                                                        • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
                                                                                                        • Opcode Fuzzy Hash: 832d7dfe82571d46151d64c4ba74b7ae12496bc5cddea04242c0c379dd164914
                                                                                                        • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
                                                                                                        APIs
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                        • GetWindowRect.USER32(?,?), ref: 004701EA
                                                                                                        • GetClientRect.USER32(?,?), ref: 004701FA
                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 00470202
                                                                                                        • GetSystemMetrics.USER32(00000008), ref: 00470216
                                                                                                        • GetSystemMetrics.USER32(00000004), ref: 00470238
                                                                                                        • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
                                                                                                        • GetSystemMetrics.USER32(00000007), ref: 00470273
                                                                                                        • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
                                                                                                        • GetSystemMetrics.USER32(00000008), ref: 004702A8
                                                                                                        • GetSystemMetrics.USER32(00000004), ref: 004702CF
                                                                                                        • SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
                                                                                                        • AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
                                                                                                        • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
                                                                                                        • SetWindowLongW.USER32(00000000,000000EB,?), ref: 00470356
                                                                                                        • GetClientRect.USER32(?,?), ref: 00470371
                                                                                                        • GetStockObject.GDI32(00000011), ref: 00470391
                                                                                                        • SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
                                                                                                        • SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
                                                                                                        • String ID: AutoIt v3 GUI
                                                                                                        • API String ID: 867697134-248962490
                                                                                                        • Opcode ID: 0d702e1f111dc4b461eb7f98f3a5a74387d5f37c8fb6fd827a42ca67ae032642
                                                                                                        • Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
                                                                                                        • Opcode Fuzzy Hash: 0d702e1f111dc4b461eb7f98f3a5a74387d5f37c8fb6fd827a42ca67ae032642
                                                                                                        • Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A
                                                                                                        APIs
                                                                                                        • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 2353593579-4108050209
                                                                                                        • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                        • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
                                                                                                        • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                        • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
                                                                                                        APIs
                                                                                                        • GetSysColor.USER32 ref: 0044A11D
                                                                                                        • GetClientRect.USER32(?,?), ref: 0044A18D
                                                                                                        • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
                                                                                                        • GetWindowDC.USER32(?), ref: 0044A1B3
                                                                                                        • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
                                                                                                        • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
                                                                                                        • GetSysColor.USER32(0000000F), ref: 0044A1EC
                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
                                                                                                        • GetSysColor.USER32(0000000F), ref: 0044A216
                                                                                                        • GetSysColor.USER32(00000005), ref: 0044A21E
                                                                                                        • GetWindowDC.USER32 ref: 0044A277
                                                                                                        • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
                                                                                                        • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
                                                                                                        • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
                                                                                                        • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
                                                                                                        • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
                                                                                                        • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
                                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
                                                                                                        • GetStockObject.GDI32(00000005), ref: 0044A312
                                                                                                        • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
                                                                                                        • String ID:
                                                                                                        • API String ID: 1744303182-0
                                                                                                        • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                        • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
                                                                                                        • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                        • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __wcsicoll$__wcsnicmp
                                                                                                        • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                                                        • API String ID: 790654849-1810252412
                                                                                                        • Opcode ID: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                        • Instruction ID: 1b62209f2aa4de5792947d5a3aa61dcd1c874d3672784017b8f4b2c72f71c34c
                                                                                                        • Opcode Fuzzy Hash: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                        • Instruction Fuzzy Hash: 7A3193B1644301A7CA00FA61DC83F5B73A85F54759F100A3FB955B61D6FA6CEA0C862F
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: InitVariant
                                                                                                        • String ID:
                                                                                                        • API String ID: 1927566239-0
                                                                                                        • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                        • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
                                                                                                        • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                        • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
                                                                                                        APIs
                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                        • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
                                                                                                        • GetForegroundWindow.USER32 ref: 0046DBA4
                                                                                                        • IsWindow.USER32(?), ref: 0046DBDE
                                                                                                        • GetDesktopWindow.USER32 ref: 0046DCB5
                                                                                                        • EnumChildWindows.USER32(00000000), ref: 0046DCBC
                                                                                                        • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                                                                                                          • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop
                                                                                                        • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                                                        • API String ID: 1322021666-1919597938
                                                                                                        • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                        • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
                                                                                                        • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                        • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
                                                                                                        APIs
                                                                                                        • GetLocalTime.KERNEL32(?), ref: 0045DED4
                                                                                                        • SystemTimeToFileTime.KERNEL32(?,?), ref: 0045DEE4
                                                                                                        • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0045DEF0
                                                                                                        • _wcsncpy.LIBCMT ref: 0045DF0F
                                                                                                        • __wsplitpath.LIBCMT ref: 0045DF54
                                                                                                        • _wcscat.LIBCMT ref: 0045DF6C
                                                                                                        • _wcscat.LIBCMT ref: 0045DF7E
                                                                                                        • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0045DF93
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFA7
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFE5
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0045DFFB
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0045E00D
                                                                                                        • _wcscpy.LIBCMT ref: 0045E019
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0045E05F
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CurrentDirectory$Time$File$Local_wcscat$System__wsplitpath_wcscpy_wcsncpy
                                                                                                        • String ID: *.*
                                                                                                        • API String ID: 3201719729-438819550
                                                                                                        • Opcode ID: 89541da3f554ebb8d42e95f45bc66f31ca584aff69b040987f949bd9346ecb30
                                                                                                        • Instruction ID: 9ef8ac46b2ec3f8a2b66e183c5d6435db2730cdd54c1860218fefef83dfd89d7
                                                                                                        • Opcode Fuzzy Hash: 89541da3f554ebb8d42e95f45bc66f31ca584aff69b040987f949bd9346ecb30
                                                                                                        • Instruction Fuzzy Hash: D061A7B25043049BC724EF65C881E9FB3E8AF94704F048E1EF98987241DB79E949CB96
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __wcsicoll$IconLoad
                                                                                                        • String ID: blank$info$question$stop$warning
                                                                                                        • API String ID: 2485277191-404129466
                                                                                                        • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                        • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
                                                                                                        • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                        • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
                                                                                                        APIs
                                                                                                        • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
                                                                                                        • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
                                                                                                        • strncnt.LIBCMT ref: 00428646
                                                                                                        • strncnt.LIBCMT ref: 0042865A
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: strncnt$CompareErrorLastString
                                                                                                        • String ID:
                                                                                                        • API String ID: 1776594460-0
                                                                                                        • Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                        • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
                                                                                                        • Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                        • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
                                                                                                        APIs
                                                                                                        • LoadIconW.USER32(?,00000063), ref: 004545DA
                                                                                                        • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
                                                                                                        • SetWindowTextW.USER32(?,?), ref: 00454606
                                                                                                        • GetDlgItem.USER32(?,000003EA), ref: 0045461F
                                                                                                        • SetWindowTextW.USER32(00000000,?), ref: 00454626
                                                                                                        • GetDlgItem.USER32(?,000003E9), ref: 00454637
                                                                                                        • SetWindowTextW.USER32(00000000,?), ref: 0045463E
                                                                                                        • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
                                                                                                        • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
                                                                                                        • GetWindowRect.USER32(?,?), ref: 00454688
                                                                                                        • SetWindowTextW.USER32(?,?), ref: 004546FD
                                                                                                        • GetDesktopWindow.USER32 ref: 00454708
                                                                                                        • GetWindowRect.USER32(00000000), ref: 0045470F
                                                                                                        • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
                                                                                                        • GetClientRect.USER32(?,?), ref: 0045476F
                                                                                                        • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
                                                                                                        • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                                        • String ID:
                                                                                                        • API String ID: 3869813825-0
                                                                                                        • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                        • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
                                                                                                        • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                        • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
                                                                                                        APIs
                                                                                                        • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
                                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
                                                                                                        • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
                                                                                                        • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
                                                                                                        • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
                                                                                                        • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
                                                                                                        • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
                                                                                                        • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
                                                                                                        • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
                                                                                                        • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
                                                                                                        • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
                                                                                                        • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
                                                                                                        • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
                                                                                                        • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
                                                                                                        • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
                                                                                                        • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
                                                                                                        • GetCursorInfo.USER32 ref: 00458E03
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Cursor$Load$Info
                                                                                                        • String ID:
                                                                                                        • API String ID: 2577412497-0
                                                                                                        • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                        • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
                                                                                                        • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                        • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
                                                                                                        APIs
                                                                                                        • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
                                                                                                        • GetFocus.USER32 ref: 004696E0
                                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 004696EB
                                                                                                        • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessagePost$CtrlFocus
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 1534620443-4108050209
                                                                                                        • Opcode ID: 3dab727c688772619e9efc5d23afb6fcae73775eddc560d175f3e695e52b8611
                                                                                                        • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
                                                                                                        • Opcode Fuzzy Hash: 3dab727c688772619e9efc5d23afb6fcae73775eddc560d175f3e695e52b8611
                                                                                                        • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 00468107
                                                                                                        • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
                                                                                                        • GetMenuItemCount.USER32(?), ref: 00468227
                                                                                                        • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
                                                                                                        • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
                                                                                                        • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
                                                                                                        • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
                                                                                                        • GetMenuItemCount.USER32 ref: 004682DC
                                                                                                        • SetMenuItemInfoW.USER32 ref: 00468317
                                                                                                        • GetCursorPos.USER32(00000000), ref: 00468322
                                                                                                        • SetForegroundWindow.USER32(?), ref: 0046832D
                                                                                                        • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
                                                                                                        • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 3993528054-4108050209
                                                                                                        • Opcode ID: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                        • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
                                                                                                        • Opcode Fuzzy Hash: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                        • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
                                                                                                        APIs
                                                                                                        • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                                                                                                          • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                          • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                          • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                        • SendMessageW.USER32(?), ref: 0046F34C
                                                                                                        • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
                                                                                                        • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
                                                                                                        • _wcscat.LIBCMT ref: 0046F3BC
                                                                                                        • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
                                                                                                        • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
                                                                                                        • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
                                                                                                        • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
                                                                                                        • DragFinish.SHELL32(?), ref: 0046F414
                                                                                                        • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
                                                                                                        • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                        • API String ID: 4085615965-3440237614
                                                                                                        • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                        • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
                                                                                                        • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                        • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __wcsicoll
                                                                                                        • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
                                                                                                        • API String ID: 3832890014-4202584635
                                                                                                        • Opcode ID: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                        • Instruction ID: bf73cd225697d97a5a257e466bf5c8c79b4efa22739c650e03c6b1f9c6e9338c
                                                                                                        • Opcode Fuzzy Hash: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                        • Instruction Fuzzy Hash: 1D01616160562122FE11322A7C03BDF15898F5139AF14447BFC05F1282FF4DDA8692EE
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 004669C4
                                                                                                        • _wcsncpy.LIBCMT ref: 00466A21
                                                                                                        • _wcsncpy.LIBCMT ref: 00466A4D
                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                        • _wcstok.LIBCMT ref: 00466A90
                                                                                                          • Part of subcall function 004142A3: __getptd.LIBCMT ref: 004142A9
                                                                                                        • _wcstok.LIBCMT ref: 00466B3F
                                                                                                        • _wcscpy.LIBCMT ref: 00466BC8
                                                                                                        • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
                                                                                                        • _wcslen.LIBCMT ref: 00466D1D
                                                                                                        • _memset.LIBCMT ref: 00466BEE
                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                        • _wcslen.LIBCMT ref: 00466D4B
                                                                                                        • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcslen$FileName_memset_wcscpy_wcsncpy_wcstok$OpenSave__getptd
                                                                                                        • String ID: X$HH
                                                                                                        • API String ID: 3021350936-1944015008
                                                                                                        • Opcode ID: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                                                        • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
                                                                                                        • Opcode Fuzzy Hash: b06cb37d3db4ad53d3a41f94d3d7a052046d00add24c9c6de48b5fd017d77e84
                                                                                                        • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 0045F4AE
                                                                                                        • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
                                                                                                        • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
                                                                                                        • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: InfoItemMenu$Sleep_memset
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 1504565804-4108050209
                                                                                                        • Opcode ID: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                        • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
                                                                                                        • Opcode Fuzzy Hash: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                        • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
                                                                                                        APIs
                                                                                                        • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
                                                                                                        • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$CreateDestroy
                                                                                                        • String ID: ,$tooltips_class32
                                                                                                        • API String ID: 1109047481-3856767331
                                                                                                        • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                        • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
                                                                                                        • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                        • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
                                                                                                        APIs
                                                                                                        • _wcsncpy.LIBCMT ref: 0045CCFA
                                                                                                        • __wsplitpath.LIBCMT ref: 0045CD3C
                                                                                                        • _wcscat.LIBCMT ref: 0045CD51
                                                                                                        • _wcscat.LIBCMT ref: 0045CD63
                                                                                                        • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                                                                                                          • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                        • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
                                                                                                        • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
                                                                                                        • _wcscpy.LIBCMT ref: 0045CE14
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
                                                                                                        • String ID: *.*
                                                                                                        • API String ID: 1153243558-438819550
                                                                                                        • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                        • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
                                                                                                        • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                        • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 00455127
                                                                                                        • GetMenuItemInfoW.USER32 ref: 00455146
                                                                                                        • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
                                                                                                        • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
                                                                                                        • GetMenuItemCount.USER32(?), ref: 004551D9
                                                                                                        • SetMenu.USER32(?,00000000), ref: 004551E7
                                                                                                        • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
                                                                                                        • DrawMenuBar.USER32 ref: 00455207
                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 1663942905-4108050209
                                                                                                        • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                        • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
                                                                                                        • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                        • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __get_daylight__invoke_watson$__gmtime64_s$__getptd_noexit
                                                                                                        • String ID:
                                                                                                        • API String ID: 1481289235-0
                                                                                                        • Opcode ID: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                        • Instruction ID: 11750150b5911b8a2d77b888e51b7102539fbc40f42687a9f62e69b5342e6946
                                                                                                        • Opcode Fuzzy Hash: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                        • Instruction Fuzzy Hash: 8461B372B00B15DBD724AB69DC81AEB73E99F84324F14452FF011D7682EB78DA808B58
                                                                                                        APIs
                                                                                                        • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
                                                                                                        • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
                                                                                                        • SendMessageW.USER32 ref: 0046FBAF
                                                                                                        • SendMessageW.USER32 ref: 0046FBE2
                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
                                                                                                        • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
                                                                                                        • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
                                                                                                        • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
                                                                                                        • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
                                                                                                        • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
                                                                                                        • SendMessageW.USER32 ref: 0046FD00
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$IconImageList_$CreateExtractReplace
                                                                                                        • String ID:
                                                                                                        • API String ID: 2632138820-0
                                                                                                        • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                        • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
                                                                                                        • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                        • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
                                                                                                        APIs
                                                                                                        • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
                                                                                                        • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
                                                                                                        • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
                                                                                                        • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
                                                                                                        • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
                                                                                                        • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
                                                                                                        • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
                                                                                                        • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
                                                                                                        • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
                                                                                                        • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
                                                                                                        • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
                                                                                                        • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
                                                                                                        • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
                                                                                                        • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
                                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CursorLoad
                                                                                                        • String ID:
                                                                                                        • API String ID: 3238433803-0
                                                                                                        • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                        • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
                                                                                                        • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                        • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
                                                                                                        APIs
                                                                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
                                                                                                        • _wcslen.LIBCMT ref: 00460B00
                                                                                                        • __swprintf.LIBCMT ref: 00460B9E
                                                                                                        • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
                                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
                                                                                                        • GetDlgCtrlID.USER32(?), ref: 00460CE6
                                                                                                        • GetWindowRect.USER32(?,?), ref: 00460D21
                                                                                                        • GetParent.USER32(?), ref: 00460D40
                                                                                                        • ScreenToClient.USER32(00000000), ref: 00460D47
                                                                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
                                                                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
                                                                                                        • String ID: %s%u
                                                                                                        • API String ID: 1899580136-679674701
                                                                                                        • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                        • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
                                                                                                        • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                        • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
                                                                                                        APIs
                                                                                                        • CoTaskMemFree.OLE32(?), ref: 0047D6D3
                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                        • StringFromCLSID.OLE32(?,?), ref: 0047D6B5
                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                        • StringFromIID.OLE32(?,?), ref: 0047D7F0
                                                                                                        • CoTaskMemFree.OLE32(?), ref: 0047D80A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: FreeFromStringTask_wcslen$_wcscpy
                                                                                                        • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
                                                                                                        • API String ID: 2485709727-934586222
                                                                                                        • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                        • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
                                                                                                        • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                        • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocPathUninitialize
                                                                                                        • String ID: HH
                                                                                                        • API String ID: 3381189665-2761332787
                                                                                                        • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                        • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
                                                                                                        • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                        • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
                                                                                                        APIs
                                                                                                        • GetDC.USER32(00000000), ref: 00434585
                                                                                                        • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
                                                                                                        • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
                                                                                                        • SelectObject.GDI32(00000000,?), ref: 004345A9
                                                                                                        • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
                                                                                                        • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
                                                                                                        • String ID: (
                                                                                                        • API String ID: 3300687185-3887548279
                                                                                                        • Opcode ID: f1a61bd92dc1e5bf4a907c179000b9c6a14a2e3466c3eeb116f883cf8bb2fa69
                                                                                                        • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
                                                                                                        • Opcode Fuzzy Hash: f1a61bd92dc1e5bf4a907c179000b9c6a14a2e3466c3eeb116f883cf8bb2fa69
                                                                                                        • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
                                                                                                        APIs
                                                                                                        • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
                                                                                                        • __swprintf.LIBCMT ref: 0045E4D9
                                                                                                        • _printf.LIBCMT ref: 0045E595
                                                                                                        • _printf.LIBCMT ref: 0045E5B7
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                        • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
                                                                                                        • API String ID: 3590180749-2894483878
                                                                                                        • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                        • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
                                                                                                        • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                        • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
                                                                                                        APIs
                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
                                                                                                        • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
                                                                                                        • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
                                                                                                        • DeleteObject.GDI32(?), ref: 0046F950
                                                                                                        • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
                                                                                                        • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
                                                                                                        • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
                                                                                                        • DeleteObject.GDI32(?), ref: 0046F9CF
                                                                                                        • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
                                                                                                        • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
                                                                                                        • DestroyIcon.USER32(?), ref: 0046FA4F
                                                                                                        • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
                                                                                                        • DeleteObject.GDI32(?), ref: 0046FA68
                                                                                                        • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 3412594756-0
                                                                                                        • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                        • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
                                                                                                        • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                        • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
                                                                                                        APIs
                                                                                                          • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                          • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                        • GetDriveTypeW.KERNEL32 ref: 0045DA30
                                                                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
                                                                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
                                                                                                        • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: SendString$_wcslen$BuffCharDriveLowerType
                                                                                                        • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                        • API String ID: 4013263488-4113822522
                                                                                                        • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                        • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
                                                                                                        • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                        • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcslen$_wcsncpy$LocalTime__wcstoi64
                                                                                                        • String ID:
                                                                                                        • API String ID: 228034949-0
                                                                                                        • Opcode ID: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                        • Instruction ID: c9113392db11e6d0b84b7dcaf0f9983ae7bcdcfbf3325debe08446cd55f13bc3
                                                                                                        • Opcode Fuzzy Hash: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                        • Instruction Fuzzy Hash: 874194B181435066DA10FF6AC8479DFB3A8EF89314F84495FF945D3162E378E64883AA
                                                                                                        APIs
                                                                                                        • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
                                                                                                        • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 00433523
                                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
                                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
                                                                                                        • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
                                                                                                        • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 0043357B
                                                                                                        • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
                                                                                                        • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
                                                                                                        • DeleteObject.GDI32(?), ref: 00433603
                                                                                                        • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                        • String ID:
                                                                                                        • API String ID: 3969911579-0
                                                                                                        • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                        • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
                                                                                                        • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                        • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
                                                                                                        APIs
                                                                                                        • GetParent.USER32 ref: 00445A8D
                                                                                                        • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
                                                                                                        • __wcsicoll.LIBCMT ref: 00445AC4
                                                                                                        • __wcsicoll.LIBCMT ref: 00445AE0
                                                                                                        • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __wcsicoll$ClassMessageNameParentSend
                                                                                                        • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                        • API String ID: 3125838495-3381328864
                                                                                                        • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                        • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
                                                                                                        • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                        • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CopyVariant$ErrorLast
                                                                                                        • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                                                                                                        • API String ID: 2286883814-4206948668
                                                                                                        • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                        • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
                                                                                                        • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                        • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
                                                                                                        APIs
                                                                                                          • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                          • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                        • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
                                                                                                        • _wcscpy.LIBCMT ref: 00475F18
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: BuffCharDriveLowerType_wcscpy_wcslen
                                                                                                        • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
                                                                                                        • API String ID: 3052893215-4176887700
                                                                                                        • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                        • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
                                                                                                        • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                        • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
                                                                                                        APIs
                                                                                                        • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                        • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
                                                                                                        • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
                                                                                                        • RegQueryValueExW.ADVAPI32 ref: 00458381
                                                                                                        • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
                                                                                                        • RegQueryValueExW.ADVAPI32 ref: 004583E8
                                                                                                        • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                                                                                                          • Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1
                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 004584BA
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
                                                                                                        • String ID: Version$\TypeLib$interface\
                                                                                                        • API String ID: 656856066-939221531
                                                                                                        • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                        • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
                                                                                                        • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                        • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
                                                                                                        APIs
                                                                                                        • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
                                                                                                        • __swprintf.LIBCMT ref: 0045E6EE
                                                                                                        • _printf.LIBCMT ref: 0045E7A9
                                                                                                        • _printf.LIBCMT ref: 0045E7D2
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                        • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                        • API String ID: 3590180749-2354261254
                                                                                                        • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                        • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
                                                                                                        • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                        • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __swprintf_wcscpy$__i64tow__itow
                                                                                                        • String ID: %.15g$0x%p$False$True
                                                                                                        • API String ID: 3038501623-2263619337
                                                                                                        • Opcode ID: 19a4eb4a0385f4e3e29933f3f54d071d1af3cac5b39b122aee5b24a105b2230c
                                                                                                        • Instruction ID: 2d826072eebb3cc9b8b6a8fde8b9da0ebc7f558755c715a4a51c402ed3db85ba
                                                                                                        • Opcode Fuzzy Hash: 19a4eb4a0385f4e3e29933f3f54d071d1af3cac5b39b122aee5b24a105b2230c
                                                                                                        • Instruction Fuzzy Hash: 5741E5B2504204ABD700EF35EC06EAB73A4EB95304F04892FFD0997282F67DD619976E
                                                                                                        APIs
                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                        • _memset.LIBCMT ref: 00458194
                                                                                                        • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
                                                                                                        • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
                                                                                                        • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
                                                                                                        • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
                                                                                                        • CLSIDFromString.OLE32(00000000,?), ref: 00458279
                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 00458296
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
                                                                                                        • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                        • API String ID: 2255324689-22481851
                                                                                                        • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                        • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
                                                                                                        • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                        • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
                                                                                                        APIs
                                                                                                        • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
                                                                                                        • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 00458615
                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                        • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
                                                                                                        • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
                                                                                                        • __wcsicoll.LIBCMT ref: 004585D6
                                                                                                        • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
                                                                                                        • RegCloseKey.ADVAPI32(?), ref: 004585F8
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
                                                                                                        • String ID: ($interface$interface\
                                                                                                        • API String ID: 2231185022-3327702407
                                                                                                        • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                        • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
                                                                                                        • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                        • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
                                                                                                        APIs
                                                                                                        • WSAStartup.WSOCK32(00000101,?), ref: 004365A5
                                                                                                        • gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
                                                                                                        • gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
                                                                                                        • _wcscpy.LIBCMT ref: 004365F5
                                                                                                        • WSACleanup.WSOCK32 ref: 004365FD
                                                                                                        • inet_ntoa.WSOCK32(00000100,?), ref: 00436624
                                                                                                        • _strcat.LIBCMT ref: 0043662F
                                                                                                        • _wcscpy.LIBCMT ref: 00436644
                                                                                                        • WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
                                                                                                        • _wcscpy.LIBCMT ref: 00436666
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
                                                                                                        • String ID: 0.0.0.0
                                                                                                        • API String ID: 2691793716-3771769585
                                                                                                        • Opcode ID: edbc70afde67a55f4b99ee40814c5331da24f6846b253968828d225e396465d4
                                                                                                        • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
                                                                                                        • Opcode Fuzzy Hash: edbc70afde67a55f4b99ee40814c5331da24f6846b253968828d225e396465d4
                                                                                                        • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
                                                                                                        APIs
                                                                                                        • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
                                                                                                        • __crt_waiting_on_module_handle.LIBCMT ref: 00416B2F
                                                                                                          • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                                                                                          • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                                                                                                        • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
                                                                                                        • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
                                                                                                        • __lock.LIBCMT ref: 00416B8A
                                                                                                        • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
                                                                                                        • __lock.LIBCMT ref: 00416BAB
                                                                                                        • ___addlocaleref.LIBCMT ref: 00416BC9
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                                                        • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                        • API String ID: 1028249917-2843748187
                                                                                                        • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                        • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
                                                                                                        • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                        • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
                                                                                                        • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
                                                                                                        • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
                                                                                                        • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
                                                                                                        • SendMessageW.USER32(?,00000402,?), ref: 0044941C
                                                                                                        • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
                                                                                                        • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$CharNext
                                                                                                        • String ID:
                                                                                                        • API String ID: 1350042424-0
                                                                                                        • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                        • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
                                                                                                        • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                        • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
                                                                                                        APIs
                                                                                                        • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
                                                                                                        • SetKeyboardState.USER32(?), ref: 00453C5A
                                                                                                        • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
                                                                                                        • GetKeyState.USER32(000000A0), ref: 00453C99
                                                                                                        • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
                                                                                                        • GetKeyState.USER32(000000A1), ref: 00453CDA
                                                                                                        • GetAsyncKeyState.USER32(00000011), ref: 00453D07
                                                                                                        • GetKeyState.USER32(00000011), ref: 00453D15
                                                                                                        • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
                                                                                                        • GetKeyState.USER32(00000012), ref: 00453D4D
                                                                                                        • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
                                                                                                        • GetKeyState.USER32(0000005B), ref: 00453D85
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: State$Async$Keyboard
                                                                                                        • String ID:
                                                                                                        • API String ID: 541375521-0
                                                                                                        • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                        • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
                                                                                                        • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                        • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
                                                                                                        APIs
                                                                                                        • GetDlgItem.USER32(?,00000001), ref: 00437DD7
                                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00437DE9
                                                                                                        • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
                                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00437E70
                                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00437E82
                                                                                                        • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
                                                                                                        • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
                                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00437EFC
                                                                                                        • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
                                                                                                        • GetDlgItem.USER32(?,000003EA), ref: 00437F55
                                                                                                        • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$ItemMoveRect$Invalidate
                                                                                                        • String ID:
                                                                                                        • API String ID: 3096461208-0
                                                                                                        • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                        • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
                                                                                                        • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                        • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                                                        • String ID:
                                                                                                        • API String ID: 136442275-0
                                                                                                        • Opcode ID: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                        • Instruction ID: e47e2093bf76b35e8f1fec89578fc46911e8a4506192668d3a16ce6d5165f020
                                                                                                        • Opcode Fuzzy Hash: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                        • Instruction Fuzzy Hash: 744124B2408345ABC235E754C885EEF73ECABD8314F44891EB68D42141EB796688C7A7
                                                                                                        APIs
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ConnectRegistry_wcslen
                                                                                                        • String ID: HH
                                                                                                        • API String ID: 535477410-2761332787
                                                                                                        • Opcode ID: e91c6bd909ad74ed1928ed0244ed8aa8a8dc52ba60fb0b240039b69f8a910896
                                                                                                        • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
                                                                                                        • Opcode Fuzzy Hash: e91c6bd909ad74ed1928ed0244ed8aa8a8dc52ba60fb0b240039b69f8a910896
                                                                                                        • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
                                                                                                        APIs
                                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
                                                                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
                                                                                                        • _wcslen.LIBCMT ref: 00460502
                                                                                                        • CharUpperBuffW.USER32(?,00000000), ref: 00460510
                                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00460589
                                                                                                        • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
                                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 00460606
                                                                                                        • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
                                                                                                        • GetWindowRect.USER32(?,?), ref: 004606AD
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
                                                                                                        • String ID: ThumbnailClass
                                                                                                        • API String ID: 4123061591-1241985126
                                                                                                        • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                        • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
                                                                                                        • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                        • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
                                                                                                        APIs
                                                                                                          • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                          • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                          • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                          • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                        • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
                                                                                                        • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
                                                                                                        • ImageList_EndDrag.COMCTL32 ref: 0046F583
                                                                                                        • ReleaseCapture.USER32 ref: 0046F589
                                                                                                        • SetWindowTextW.USER32(?,00000000), ref: 0046F620
                                                                                                        • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
                                                                                                        • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
                                                                                                        • API String ID: 2483343779-2060113733
                                                                                                        • Opcode ID: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                                                        • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
                                                                                                        • Opcode Fuzzy Hash: b963958ab96ed52e1c3ab3b45c628991f908dc465e455618a5f6fc8545d443fb
                                                                                                        • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
                                                                                                        APIs
                                                                                                        • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
                                                                                                        • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
                                                                                                        • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
                                                                                                        • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
                                                                                                        • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
                                                                                                        • GetClientRect.USER32(?,?), ref: 0046FEF2
                                                                                                        • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
                                                                                                        • DestroyIcon.USER32(?), ref: 0046FFCC
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
                                                                                                        • String ID: 2
                                                                                                        • API String ID: 1331449709-450215437
                                                                                                        • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                        • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
                                                                                                        • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                        • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
                                                                                                        APIs
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?,?,00000000,static,00000000,00000000,?,?,00000000,00000000,?,00000000), ref: 00450EE1
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DestroyWindow
                                                                                                        • String ID: static
                                                                                                        • API String ID: 3375834691-2160076837
                                                                                                        • Opcode ID: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                                        • Instruction ID: 4605c95b1b006c90d65e271c0fdf07f62d21d56273c2870bf7f2e3decf5281c5
                                                                                                        • Opcode Fuzzy Hash: 88f11647011456fbb04f7235260bd1d02a964e72c1c4e3b3fb6640230c73d37f
                                                                                                        • Instruction Fuzzy Hash: 4531B572200300BBD7109B64DC45F6BB3A8EBC9711F204A2EFA50D72C0D7B4E8048B69
                                                                                                        APIs
                                                                                                        • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
                                                                                                        • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
                                                                                                        • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
                                                                                                        • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
                                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
                                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
                                                                                                        • _memcmp.LIBCMT ref: 004394A9
                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
                                                                                                        Strings
                                                                                                        • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
                                                                                                        • SeIncreaseQuotaPrivilege, xrefs: 0043946A
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
                                                                                                        • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                                                                                                        • API String ID: 1446985595-805462909
                                                                                                        • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                        • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
                                                                                                        • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                        • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
                                                                                                        APIs
                                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D848
                                                                                                        • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
                                                                                                        • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorMode$DriveType
                                                                                                        • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
                                                                                                        • API String ID: 2907320926-41864084
                                                                                                        • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                        • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
                                                                                                        • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                        • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
                                                                                                        APIs
                                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
                                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
                                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
                                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
                                                                                                        • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
                                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
                                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
                                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
                                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                        • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
                                                                                                        • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                        • String ID:
                                                                                                        • API String ID: 1932665248-0
                                                                                                        • Opcode ID: 16f99e80be173eecdd1bb573f6b7f825babaa5351af7cc3efc94bb11c862a2f8
                                                                                                        • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
                                                                                                        • Opcode Fuzzy Hash: 16f99e80be173eecdd1bb573f6b7f825babaa5351af7cc3efc94bb11c862a2f8
                                                                                                        • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
                                                                                                        • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
                                                                                                        • _memset.LIBCMT ref: 004481BA
                                                                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
                                                                                                        • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
                                                                                                        • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
                                                                                                        • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
                                                                                                        • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
                                                                                                        • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
                                                                                                        • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$LongWindow_memset
                                                                                                        • String ID:
                                                                                                        • API String ID: 830647256-0
                                                                                                        • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                        • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
                                                                                                        • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                        • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
                                                                                                        APIs
                                                                                                          • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                        • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
                                                                                                        • DeleteObject.GDI32(00540000), ref: 0046EB4F
                                                                                                        • DestroyIcon.USER32(006D0065), ref: 0046EB67
                                                                                                        • DeleteObject.GDI32(7BC31BBE), ref: 0046EB7F
                                                                                                        • DestroyWindow.USER32(00610044), ref: 0046EB97
                                                                                                        • DestroyIcon.USER32(?), ref: 0046EBBF
                                                                                                        • DestroyIcon.USER32(?), ref: 0046EBCD
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 802431696-0
                                                                                                        • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                        • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
                                                                                                        • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                        • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
                                                                                                        APIs
                                                                                                        • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
                                                                                                        • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
                                                                                                        • GetKeyState.USER32(000000A0), ref: 00444E26
                                                                                                        • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
                                                                                                        • GetKeyState.USER32(000000A1), ref: 00444E51
                                                                                                        • GetAsyncKeyState.USER32(00000011), ref: 00444E69
                                                                                                        • GetKeyState.USER32(00000011), ref: 00444E77
                                                                                                        • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
                                                                                                        • GetKeyState.USER32(00000012), ref: 00444E9D
                                                                                                        • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
                                                                                                        • GetKeyState.USER32(0000005B), ref: 00444EC3
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: State$Async$Keyboard
                                                                                                        • String ID:
                                                                                                        • API String ID: 541375521-0
                                                                                                        • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                        • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
                                                                                                        • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                        • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
                                                                                                        • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
                                                                                                        • _wcslen.LIBCMT ref: 00450944
                                                                                                        • _wcscat.LIBCMT ref: 00450955
                                                                                                        • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
                                                                                                        • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$Window_wcscat_wcslen
                                                                                                        • String ID: -----$SysListView32
                                                                                                        • API String ID: 4008455318-3975388722
                                                                                                        • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                        • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
                                                                                                        • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                        • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 00448625
                                                                                                        • CreateMenu.USER32 ref: 0044863C
                                                                                                        • SetMenu.USER32(?,00000000), ref: 0044864C
                                                                                                        • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
                                                                                                        • IsMenu.USER32(?), ref: 004486EB
                                                                                                        • CreatePopupMenu.USER32 ref: 004486F5
                                                                                                        • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
                                                                                                        • DrawMenuBar.USER32 ref: 00448742
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 176399719-4108050209
                                                                                                        • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                        • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
                                                                                                        • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                        • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
                                                                                                        APIs
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
                                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 00469289
                                                                                                        • GetParent.USER32 ref: 004692A4
                                                                                                        • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
                                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 004692AE
                                                                                                        • GetParent.USER32 ref: 004692C7
                                                                                                        • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                        • String ID: ComboBox$ListBox
                                                                                                        • API String ID: 2040099840-1403004172
                                                                                                        • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                        • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
                                                                                                        • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                        • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
                                                                                                        APIs
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
                                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 00469483
                                                                                                        • GetParent.USER32 ref: 0046949E
                                                                                                        • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
                                                                                                        • GetDlgCtrlID.USER32(00000000), ref: 004694A8
                                                                                                        • GetParent.USER32 ref: 004694C1
                                                                                                        • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                        • String ID: ComboBox$ListBox
                                                                                                        • API String ID: 2040099840-1403004172
                                                                                                        • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                        • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
                                                                                                        • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                        • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
                                                                                                        APIs
                                                                                                          • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
                                                                                                        • SendMessageW.USER32(75C123D0,00001001,00000000,00000000), ref: 00448E73
                                                                                                        • SendMessageW.USER32(75C123D0,00001026,00000000,00000000), ref: 00448E7E
                                                                                                          • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$BrushCreateDeleteObjectSolid
                                                                                                        • String ID:
                                                                                                        • API String ID: 3771399671-0
                                                                                                        • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                        • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
                                                                                                        • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                        • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: InitVariant$_malloc_wcscpy_wcslen
                                                                                                        • String ID:
                                                                                                        • API String ID: 3413494760-0
                                                                                                        • Opcode ID: afb533e23b19910be0c027df8fa87fd227b592e7e5a0e6e969ae1a59b8da4157
                                                                                                        • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
                                                                                                        • Opcode Fuzzy Hash: afb533e23b19910be0c027df8fa87fd227b592e7e5a0e6e969ae1a59b8da4157
                                                                                                        • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
                                                                                                        APIs
                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 004377D7
                                                                                                        • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
                                                                                                        • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
                                                                                                        • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
                                                                                                        • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                        • String ID:
                                                                                                        • API String ID: 2156557900-0
                                                                                                        • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                        • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
                                                                                                        • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                        • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __wcsicoll
                                                                                                        • String ID: 0%d$DOWN$OFF
                                                                                                        • API String ID: 3832890014-468733193
                                                                                                        • Opcode ID: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                        • Instruction ID: 3901981f80fa7430cd77b89167089bc3925961a07aad88d0cc2f25a35af8916b
                                                                                                        • Opcode Fuzzy Hash: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                        • Instruction Fuzzy Hash: B7F1D8614083856DEB21EB21C845BAF7BE85F95309F08092FF98212193D7BCD68DC76B
                                                                                                        APIs
                                                                                                        • VariantInit.OLEAUT32(00000000), ref: 0045E959
                                                                                                        • VariantCopy.OLEAUT32(00000000), ref: 0045E963
                                                                                                        • VariantClear.OLEAUT32 ref: 0045E970
                                                                                                        • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
                                                                                                        • __swprintf.LIBCMT ref: 0045EB1F
                                                                                                        • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
                                                                                                        • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
                                                                                                        Strings
                                                                                                        • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Variant$InitTime$ClearCopyFromSystem__swprintf
                                                                                                        • String ID: %4d%02d%02d%02d%02d%02d
                                                                                                        • API String ID: 43541914-1568723262
                                                                                                        • Opcode ID: 59f20d5c687eca5b8ac21bf224ed8e62dc0999386ac77495242af5446a13f09a
                                                                                                        • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
                                                                                                        • Opcode Fuzzy Hash: 59f20d5c687eca5b8ac21bf224ed8e62dc0999386ac77495242af5446a13f09a
                                                                                                        • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
                                                                                                        APIs
                                                                                                        • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
                                                                                                        • Sleep.KERNEL32(0000000A), ref: 0042FE6E
                                                                                                        • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DecrementInterlocked$Sleep
                                                                                                        • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
                                                                                                        • API String ID: 2250217261-3412429629
                                                                                                        • Opcode ID: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                                        • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
                                                                                                        • Opcode Fuzzy Hash: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                                        • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                                        • API String ID: 0-1603158881
                                                                                                        • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                        • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
                                                                                                        • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                        • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 00479D1F
                                                                                                        • VariantInit.OLEAUT32(?), ref: 00479F06
                                                                                                        • VariantClear.OLEAUT32(?), ref: 00479F11
                                                                                                        • VariantInit.OLEAUT32(?), ref: 00479DF7
                                                                                                          • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                                                                                                          • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                                                                                                          • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
                                                                                                        • VariantClear.OLEAUT32(?), ref: 00479F9C
                                                                                                          • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Variant$Copy$ClearInit$ErrorLast_memset
                                                                                                        • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                                        • API String ID: 665237470-60002521
                                                                                                        • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                        • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
                                                                                                        • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                        • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
                                                                                                        APIs
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ConnectRegistry_wcslen
                                                                                                        • String ID: HH
                                                                                                        • API String ID: 535477410-2761332787
                                                                                                        • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                        • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
                                                                                                        • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                        • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 0045F317
                                                                                                        • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
                                                                                                        • IsMenu.USER32(?), ref: 0045F380
                                                                                                        • CreatePopupMenu.USER32 ref: 0045F3C5
                                                                                                        • GetMenuItemCount.USER32(?), ref: 0045F42F
                                                                                                        • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                                                        • String ID: 0$2
                                                                                                        • API String ID: 3311875123-3793063076
                                                                                                        • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                        • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
                                                                                                        • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                        • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
                                                                                                        APIs
                                                                                                        • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\fAzUnj6Djg.exe), ref: 0043719E
                                                                                                        • LoadStringW.USER32(00000000), ref: 004371A7
                                                                                                        • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
                                                                                                        • LoadStringW.USER32(00000000), ref: 004371C0
                                                                                                        • _printf.LIBCMT ref: 004371EC
                                                                                                        • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
                                                                                                        Strings
                                                                                                        • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
                                                                                                        • C:\Users\user\Desktop\fAzUnj6Djg.exe, xrefs: 00437189
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: HandleLoadModuleString$Message_printf
                                                                                                        • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\fAzUnj6Djg.exe
                                                                                                        • API String ID: 220974073-781578826
                                                                                                        • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                        • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
                                                                                                        • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                        • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                        • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
                                                                                                        • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                        • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
                                                                                                        APIs
                                                                                                          • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\fAzUnj6Djg.exe,?,C:\Users\user\Desktop\fAzUnj6Djg.exe,004A8E80,C:\Users\user\Desktop\fAzUnj6Djg.exe,0040F3D2), ref: 0040FFCA
                                                                                                          • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                        • lstrcmpiW.KERNEL32(?,?), ref: 0045355E
                                                                                                        • MoveFileW.KERNEL32(?,?), ref: 0045358E
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$AttributesFullMoveNamePathlstrcmpi
                                                                                                        • String ID:
                                                                                                        • API String ID: 978794511-0
                                                                                                        • Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                        • Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
                                                                                                        • Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                        • Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                        • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
                                                                                                        • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                        • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
                                                                                                        APIs
                                                                                                          • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                                                                                                          • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                                                                                                          • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
                                                                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
                                                                                                        • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
                                                                                                        • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
                                                                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
                                                                                                        • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
                                                                                                        • Sleep.KERNEL32(00000000), ref: 00445D70
                                                                                                        • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
                                                                                                        • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
                                                                                                        • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 2014098862-0
                                                                                                        • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                        • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
                                                                                                        • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                        • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressProc_malloc$_strcat_strlen
                                                                                                        • String ID: AU3_FreeVar
                                                                                                        • API String ID: 2184576858-771828931
                                                                                                        • Opcode ID: 10d9e78008ba5b5703de8dc23ed72c3cd296113dc033390a1be7ca980e1f1503
                                                                                                        • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
                                                                                                        • Opcode Fuzzy Hash: 10d9e78008ba5b5703de8dc23ed72c3cd296113dc033390a1be7ca980e1f1503
                                                                                                        • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
                                                                                                        APIs
                                                                                                        • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
                                                                                                        • DestroyWindow.USER32(?), ref: 0042A751
                                                                                                        • UnregisterHotKey.USER32(?), ref: 0042A778
                                                                                                        • FreeLibrary.KERNEL32(?), ref: 0042A822
                                                                                                        • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
                                                                                                        • String ID: close all
                                                                                                        • API String ID: 4174999648-3243417748
                                                                                                        • Opcode ID: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                                                        • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
                                                                                                        • Opcode Fuzzy Hash: 9f9deb73285226e6ba240568d142da5fec9cf520cd27fc9a3a2cacaca98377aa
                                                                                                        • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
                                                                                                        APIs
                                                                                                        • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
                                                                                                        • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
                                                                                                        • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
                                                                                                        • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
                                                                                                        • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
                                                                                                        • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                                                                                                          • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                                                                                        • String ID:
                                                                                                        • API String ID: 1291720006-3916222277
                                                                                                        • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                        • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
                                                                                                        • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                        • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorLastselect
                                                                                                        • String ID: HH
                                                                                                        • API String ID: 215497628-2761332787
                                                                                                        • Opcode ID: 0c289dde452dc5b8e8f80b5941646edeec8777aba5bf19acf69e203ec63bbfa9
                                                                                                        • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
                                                                                                        • Opcode Fuzzy Hash: 0c289dde452dc5b8e8f80b5941646edeec8777aba5bf19acf69e203ec63bbfa9
                                                                                                        • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __snwprintf__wcsicoll_wcscpy
                                                                                                        • String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
                                                                                                        • API String ID: 1729044348-3708979750
                                                                                                        • Opcode ID: e5856c69d37335927e932bb259c431c810e65197c095b32473e915812f67d75c
                                                                                                        • Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
                                                                                                        • Opcode Fuzzy Hash: e5856c69d37335927e932bb259c431c810e65197c095b32473e915812f67d75c
                                                                                                        • Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA
                                                                                                        APIs
                                                                                                          • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\fAzUnj6Djg.exe,?,C:\Users\user\Desktop\fAzUnj6Djg.exe,004A8E80,C:\Users\user\Desktop\fAzUnj6Djg.exe,0040F3D2), ref: 0040FFCA
                                                                                                        • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
                                                                                                        • MoveFileW.KERNEL32(?,?), ref: 0044BC38
                                                                                                        • _wcscat.LIBCMT ref: 0044BCAA
                                                                                                        • _wcslen.LIBCMT ref: 0044BCB7
                                                                                                        • _wcslen.LIBCMT ref: 0044BCCB
                                                                                                        • SHFileOperationW.SHELL32 ref: 0044BD16
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
                                                                                                        • String ID: \*.*
                                                                                                        • API String ID: 2326526234-1173974218
                                                                                                        • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                        • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
                                                                                                        • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                        • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
                                                                                                        APIs
                                                                                                          • Part of subcall function 00436328: _wcsncpy.LIBCMT ref: 0043633C
                                                                                                        • _wcslen.LIBCMT ref: 004366DD
                                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 00436700
                                                                                                        • GetLastError.KERNEL32 ref: 0043670F
                                                                                                        • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
                                                                                                        • _wcsrchr.LIBCMT ref: 0043674C
                                                                                                          • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
                                                                                                        • String ID: \
                                                                                                        • API String ID: 321622961-2967466578
                                                                                                        • Opcode ID: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                                                        • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
                                                                                                        • Opcode Fuzzy Hash: 1eb455b432650c328f353f4bd1bc621d200bc06401c5471b489e88a9126e4646
                                                                                                        • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __wcsnicmp
                                                                                                        • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                                        • API String ID: 1038674560-2734436370
                                                                                                        • Opcode ID: 8fabdde956d602f6b8b7368bcff20dfc7d0b0c72369e2d81c3549115c9808aba
                                                                                                        • Instruction ID: f72ce1d64a5a3b865947b719243e4701f1ba8c8209579f194a7ae3ad15c73224
                                                                                                        • Opcode Fuzzy Hash: 8fabdde956d602f6b8b7368bcff20dfc7d0b0c72369e2d81c3549115c9808aba
                                                                                                        • Instruction Fuzzy Hash: 1B21F87261161067E730B659DCC2BDB63985F65305F04406BF800AA247D6ADA98A83AA
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 8a5e7e2b220d2e4bb8ffc9ff05fb60d96dc8bc30e577e31ee69d5eb2f1750fd2
                                                                                                        • Instruction ID: 650af14def374fe6fd11052fbef22cb8aa6c894e3601bf285572d08ae3c4fed9
                                                                                                        • Opcode Fuzzy Hash: 8a5e7e2b220d2e4bb8ffc9ff05fb60d96dc8bc30e577e31ee69d5eb2f1750fd2
                                                                                                        • Instruction Fuzzy Hash: 439192726043009BD710EF65DC82BABB3E9AFD4714F004D2EF548E7291D779E944875A
                                                                                                        APIs
                                                                                                        • DeleteObject.GDI32(?), ref: 0044157D
                                                                                                        • GetDC.USER32(00000000), ref: 00441585
                                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
                                                                                                        • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
                                                                                                        • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
                                                                                                        • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
                                                                                                        • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
                                                                                                        • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 3864802216-0
                                                                                                        • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                        • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
                                                                                                        • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                        • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
                                                                                                        APIs
                                                                                                        • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                          • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                          • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                          • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                        • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                          • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                        • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                          • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                        • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                        • ExitThread.KERNEL32 ref: 0041410F
                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                        • __freefls@4.LIBCMT ref: 00414135
                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                        • String ID:
                                                                                                        • API String ID: 1925773019-0
                                                                                                        • Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                        • Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
                                                                                                        • Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                        • Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C
                                                                                                        APIs
                                                                                                        • VariantClear.OLEAUT32(00000038), ref: 004357C3
                                                                                                        • VariantClear.OLEAUT32(00000058), ref: 004357C9
                                                                                                        • VariantClear.OLEAUT32(00000068), ref: 004357CF
                                                                                                        • VariantClear.OLEAUT32(00000078), ref: 004357D5
                                                                                                        • VariantClear.OLEAUT32(00000088), ref: 004357DE
                                                                                                        • VariantClear.OLEAUT32(00000048), ref: 004357E4
                                                                                                        • VariantClear.OLEAUT32(00000098), ref: 004357ED
                                                                                                        • VariantClear.OLEAUT32(000000A8), ref: 004357F6
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ClearVariant
                                                                                                        • String ID:
                                                                                                        • API String ID: 1473721057-0
                                                                                                        • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                        • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
                                                                                                        • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                        • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
                                                                                                        APIs
                                                                                                        • WSAStartup.WSOCK32(00000101,?,?), ref: 00464ADE
                                                                                                          • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                        • inet_addr.WSOCK32(?,00000000,?,?,00000101,?,?), ref: 00464B1F
                                                                                                        • gethostbyname.WSOCK32(?,?,00000000,?,?,00000101,?,?), ref: 00464B29
                                                                                                        • _memset.LIBCMT ref: 00464B92
                                                                                                        • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00464CDE
                                                                                                        • WSACleanup.WSOCK32 ref: 00464CE4
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memsetgethostbynameinet_addr
                                                                                                        • String ID:
                                                                                                        • API String ID: 3424476444-0
                                                                                                        • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                        • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
                                                                                                        • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                        • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
                                                                                                        APIs
                                                                                                        • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MetricsSystem
                                                                                                        • String ID:
                                                                                                        • API String ID: 4116985748-0
                                                                                                        • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                        • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
                                                                                                        • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                        • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
                                                                                                        APIs
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ConnectRegistry_wcslen
                                                                                                        • String ID:
                                                                                                        • API String ID: 535477410-0
                                                                                                        • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                        • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
                                                                                                        • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                        • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
                                                                                                        APIs
                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                        • _memset.LIBCMT ref: 004538C4
                                                                                                        • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
                                                                                                        • _wcslen.LIBCMT ref: 00453960
                                                                                                        • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
                                                                                                        • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ItemMenu$Info_wcslen$Default_memset_wcscpy
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 3530711334-4108050209
                                                                                                        • Opcode ID: c8c2b72c749714a23e45c10816ef9459d7fe91b5f095051f547869ed1843acb9
                                                                                                        • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
                                                                                                        • Opcode Fuzzy Hash: c8c2b72c749714a23e45c10816ef9459d7fe91b5f095051f547869ed1843acb9
                                                                                                        • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
                                                                                                        APIs
                                                                                                        • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
                                                                                                        • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
                                                                                                        • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
                                                                                                        • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                                        • String ID: HH
                                                                                                        • API String ID: 3488606520-2761332787
                                                                                                        • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                        • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
                                                                                                        • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                        • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
                                                                                                        APIs
                                                                                                          • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                          • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                          • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                        • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                        • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                        • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                        • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                        • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                        • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                        • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                        • String ID:
                                                                                                        • API String ID: 4082120231-0
                                                                                                        • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                        • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
                                                                                                        • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                        • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
                                                                                                        APIs
                                                                                                          • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                          • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                          • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                        • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                        • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                        • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                        • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                        • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                        • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                        • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                        • String ID:
                                                                                                        • API String ID: 4082120231-0
                                                                                                        • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                        • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
                                                                                                        • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                        • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
                                                                                                        • String ID:
                                                                                                        • API String ID: 288456094-0
                                                                                                        • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                        • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
                                                                                                        • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                        • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
                                                                                                        APIs
                                                                                                        • GetParent.USER32(?), ref: 004449B0
                                                                                                        • GetKeyboardState.USER32(?), ref: 004449C3
                                                                                                        • SetKeyboardState.USER32(?), ref: 00444A0F
                                                                                                        • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
                                                                                                        • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
                                                                                                        • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
                                                                                                        • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessagePost$KeyboardState$Parent
                                                                                                        • String ID:
                                                                                                        • API String ID: 87235514-0
                                                                                                        • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                        • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
                                                                                                        • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                        • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
                                                                                                        APIs
                                                                                                        • GetParent.USER32(?), ref: 00444BA9
                                                                                                        • GetKeyboardState.USER32(?), ref: 00444BBC
                                                                                                        • SetKeyboardState.USER32(?), ref: 00444C08
                                                                                                        • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
                                                                                                        • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
                                                                                                        • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
                                                                                                        • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessagePost$KeyboardState$Parent
                                                                                                        • String ID:
                                                                                                        • API String ID: 87235514-0
                                                                                                        • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                        • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
                                                                                                        • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                        • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                        • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
                                                                                                        • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                        • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
                                                                                                        APIs
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ConnectRegistry_wcslen
                                                                                                        • String ID: HH
                                                                                                        • API String ID: 535477410-2761332787
                                                                                                        • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                        • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
                                                                                                        • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                        • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 00457C34
                                                                                                        • _memset.LIBCMT ref: 00457CE8
                                                                                                        • ShellExecuteExW.SHELL32(?), ref: 00457D34
                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                        • CloseHandle.KERNEL32(?), ref: 00457DDD
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _memset$CloseExecuteHandleShell_wcscpy_wcslen
                                                                                                        • String ID: <$@
                                                                                                        • API String ID: 1325244542-1426351568
                                                                                                        • Opcode ID: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                                                        • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
                                                                                                        • Opcode Fuzzy Hash: bce0cc86945754dfb230170ecd4c21a915d6526e7c9b1e7fd723952314da78dd
                                                                                                        • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
                                                                                                        APIs
                                                                                                        • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
                                                                                                        • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
                                                                                                        • __wsplitpath.LIBCMT ref: 004737E1
                                                                                                          • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                        • _wcscat.LIBCMT ref: 004737F6
                                                                                                        • __wcsicoll.LIBCMT ref: 00473818
                                                                                                        • Process32NextW.KERNEL32(00000000,?), ref: 00473844
                                                                                                        • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                        • String ID:
                                                                                                        • API String ID: 2547909840-0
                                                                                                        • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                        • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
                                                                                                        • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                        • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
                                                                                                        • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
                                                                                                        • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 2354583917-0
                                                                                                        • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                        • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
                                                                                                        • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                        • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
                                                                                                        APIs
                                                                                                          • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                        • GetMenu.USER32 ref: 004776AA
                                                                                                        • GetMenuItemCount.USER32(00000000), ref: 004776CC
                                                                                                        • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
                                                                                                        • _wcslen.LIBCMT ref: 0047771A
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Menu$CountItemStringWindow_wcslen
                                                                                                        • String ID:
                                                                                                        • API String ID: 1823500076-0
                                                                                                        • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                        • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
                                                                                                        • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                        • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
                                                                                                        APIs
                                                                                                        • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
                                                                                                        • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
                                                                                                        • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                        • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                        • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$Enable$Show$MessageMoveSend
                                                                                                        • String ID:
                                                                                                        • API String ID: 896007046-0
                                                                                                        • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                        • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
                                                                                                        • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                        • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                        • SendMessageW.USER32(001F1B20,000000F1,00000000,00000000), ref: 004414C6
                                                                                                        • SendMessageW.USER32(001F1B20,000000F1,00000001,00000000), ref: 004414F1
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$LongWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 312131281-0
                                                                                                        • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                        • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
                                                                                                        • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                        • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 004484C4
                                                                                                        • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
                                                                                                        • IsMenu.USER32(?), ref: 0044857B
                                                                                                        • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
                                                                                                        • DrawMenuBar.USER32 ref: 004485E4
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Menu$Item$DrawInfoInsert_memset
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 3866635326-4108050209
                                                                                                        • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                        • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
                                                                                                        • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                        • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
                                                                                                        APIs
                                                                                                        • InterlockedIncrement.KERNEL32 ref: 0047247C
                                                                                                        • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
                                                                                                        • Sleep.KERNEL32(0000000A), ref: 00472499
                                                                                                        • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
                                                                                                        • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Interlocked$DecrementIncrement$Sleep
                                                                                                        • String ID: 0vH
                                                                                                        • API String ID: 327565842-3662162768
                                                                                                        • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                        • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
                                                                                                        • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                        • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
                                                                                                        • GetFocus.USER32 ref: 00448B1C
                                                                                                        • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                        • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                        • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$Enable$Show$FocusMessageSend
                                                                                                        • String ID:
                                                                                                        • API String ID: 3429747543-0
                                                                                                        • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                        • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
                                                                                                        • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                        • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
                                                                                                        APIs
                                                                                                        • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                        • _memset.LIBCMT ref: 00401C62
                                                                                                        • _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                        • _wcscpy.LIBCMT ref: 00401CBD
                                                                                                        • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
                                                                                                        • String ID: Line:
                                                                                                        • API String ID: 1620655955-1585850449
                                                                                                        • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                        • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
                                                                                                        • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                        • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B
                                                                                                        APIs
                                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
                                                                                                        • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
                                                                                                        • __swprintf.LIBCMT ref: 0045D3CC
                                                                                                        • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorMode$InformationVolume__swprintf
                                                                                                        • String ID: %lu$HH
                                                                                                        • API String ID: 3164766367-3924996404
                                                                                                        • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                        • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
                                                                                                        • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                        • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
                                                                                                        • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
                                                                                                        • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
                                                                                                        • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
                                                                                                        • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend
                                                                                                        • String ID: Msctls_Progress32
                                                                                                        • API String ID: 3850602802-3636473452
                                                                                                        • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                        • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
                                                                                                        • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                        • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
                                                                                                        APIs
                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 00455451
                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 0045545F
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Destroy$DeleteImageList_ObjectWindow$Icon
                                                                                                        • String ID:
                                                                                                        • API String ID: 3985565216-0
                                                                                                        • Opcode ID: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                        • Instruction ID: 02eb1b45cc7e926b76574f27881fb1e8d9d372094f4d7b34cf8607babd6cb63d
                                                                                                        • Opcode Fuzzy Hash: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                        • Instruction Fuzzy Hash: EA213270200A019FCB20DF65CAD4B2A77A9BF45312F50855EED45CB352DB39EC45CB69
                                                                                                        APIs
                                                                                                        • ___set_flsgetvalue.LIBCMT ref: 00415737
                                                                                                        • __calloc_crt.LIBCMT ref: 00415743
                                                                                                        • __getptd.LIBCMT ref: 00415750
                                                                                                        • CreateThread.KERNEL32(00000000,?,0041568B,00000000,00000004,00000000), ref: 00415776
                                                                                                        • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00415786
                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415791
                                                                                                        • __dosmaperr.LIBCMT ref: 004157A9
                                                                                                          • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                          • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                        • String ID:
                                                                                                        • API String ID: 1269668773-0
                                                                                                        • Opcode ID: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                                        • Instruction ID: 083f1b3d72dc2b4e3073d7627409da2efaae6cca9fbdfa2eb2c15b7cb2a145f7
                                                                                                        • Opcode Fuzzy Hash: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                                        • Instruction Fuzzy Hash: 4511E672501604EFC720AF76DC868DF7BA4EF80334F21412FF525922D1DB788981966D
                                                                                                        APIs
                                                                                                          • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                                                                                                          • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
                                                                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
                                                                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
                                                                                                        • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
                                                                                                        • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
                                                                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
                                                                                                        • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
                                                                                                        • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                        • String ID:
                                                                                                        • API String ID: 1957940570-0
                                                                                                        • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                        • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
                                                                                                        • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                        • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
                                                                                                        APIs
                                                                                                        • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                          • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                          • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                          • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                        • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                          • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                        • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                          • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                        • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                        • ExitThread.KERNEL32 ref: 004156BD
                                                                                                        • __freefls@4.LIBCMT ref: 004156D9
                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                        • String ID:
                                                                                                        • API String ID: 4166825349-0
                                                                                                        • Opcode ID: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                        • Instruction ID: 1015f584654e325efa3cacb901eba7c9ae2b5aefa54885f90b4e6d99173acdac
                                                                                                        • Opcode Fuzzy Hash: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                        • Instruction Fuzzy Hash: 14F049745007009BD704BF72DD159DE7B69AF85345761C85FB80897222DA3DC9C1CB9C
                                                                                                        APIs
                                                                                                        • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
                                                                                                        • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                        • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
                                                                                                        • API String ID: 2574300362-3261711971
                                                                                                        • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                        • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
                                                                                                        • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                        • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                        • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
                                                                                                        • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                        • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
                                                                                                        APIs
                                                                                                        • GetClientRect.USER32(?,?), ref: 00433724
                                                                                                        • GetWindowRect.USER32(00000000,?), ref: 00433757
                                                                                                        • GetClientRect.USER32(0000001D,?), ref: 004337AC
                                                                                                        • GetSystemMetrics.USER32(0000000F), ref: 00433800
                                                                                                        • GetWindowRect.USER32(?,?), ref: 00433814
                                                                                                        • ScreenToClient.USER32(?,?), ref: 00433842
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                                                        • String ID:
                                                                                                        • API String ID: 3220332590-0
                                                                                                        • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                        • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
                                                                                                        • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                        • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _malloc_wcslen$_strcat_wcscpy
                                                                                                        • String ID:
                                                                                                        • API String ID: 1612042205-0
                                                                                                        • Opcode ID: b8a3413a850b3e9d022a14bc02158d0a95917de16b2476bc53e0af5cb97ab780
                                                                                                        • Instruction ID: 39b6431fb86a1cae222df6ecce28f21653e085caad8de22f1e35678e4483a9b6
                                                                                                        • Opcode Fuzzy Hash: b8a3413a850b3e9d022a14bc02158d0a95917de16b2476bc53e0af5cb97ab780
                                                                                                        • Instruction Fuzzy Hash: CD613B70504202EFCB10EF29D58096AB3E5FF48305B50496EF8859B306D738EE59DB9A
                                                                                                        APIs
                                                                                                        • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
                                                                                                        • SetKeyboardState.USER32(00000080), ref: 0044C59B
                                                                                                        • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
                                                                                                        • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
                                                                                                        • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
                                                                                                        • SendInput.USER32 ref: 0044C6E2
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessagePost$KeyboardState$InputSend
                                                                                                        • String ID:
                                                                                                        • API String ID: 2221674350-0
                                                                                                        • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                        • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
                                                                                                        • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                        • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcscpy$_wcscat
                                                                                                        • String ID:
                                                                                                        • API String ID: 2037614760-0
                                                                                                        • Opcode ID: 43efba16cd806b31402fe34b2becc3a5af32a5b4a383a164d4ea5773e04486ac
                                                                                                        • Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
                                                                                                        • Opcode Fuzzy Hash: 43efba16cd806b31402fe34b2becc3a5af32a5b4a383a164d4ea5773e04486ac
                                                                                                        • Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE
                                                                                                        APIs
                                                                                                        • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
                                                                                                        • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                        • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                        • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                        • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                        • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 4189319755-0
                                                                                                        • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                        • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
                                                                                                        • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                        • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
                                                                                                        APIs
                                                                                                        • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                        • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
                                                                                                        • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
                                                                                                        • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
                                                                                                        • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                        • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                        • String ID:
                                                                                                        • API String ID: 1726766782-0
                                                                                                        • Opcode ID: d1f4c8b32701f3515452156a35d83f93081eba70680028f938022ee8972e20b1
                                                                                                        • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
                                                                                                        • Opcode Fuzzy Hash: d1f4c8b32701f3515452156a35d83f93081eba70680028f938022ee8972e20b1
                                                                                                        • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
                                                                                                        APIs
                                                                                                        • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
                                                                                                        • EnableWindow.USER32(?,00000000), ref: 0044111A
                                                                                                        • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
                                                                                                        • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
                                                                                                        • EnableWindow.USER32(?,00000001), ref: 004411B3
                                                                                                        • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$Show$Enable$MessageSend
                                                                                                        • String ID:
                                                                                                        • API String ID: 642888154-0
                                                                                                        • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                        • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
                                                                                                        • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                        • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
                                                                                                        • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
                                                                                                        • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
                                                                                                        • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
                                                                                                        • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$LongWindow$InvalidateRect
                                                                                                        • String ID:
                                                                                                        • API String ID: 1976402638-0
                                                                                                        • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                        • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
                                                                                                        • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                        • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
                                                                                                        APIs
                                                                                                        • GetForegroundWindow.USER32 ref: 00442597
                                                                                                          • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
                                                                                                        • GetDesktopWindow.USER32 ref: 004425BF
                                                                                                        • GetWindowRect.USER32(00000000), ref: 004425C6
                                                                                                        • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                                                                                                          • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                        • GetCursorPos.USER32(?), ref: 00442624
                                                                                                        • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                                        • String ID:
                                                                                                        • API String ID: 4137160315-0
                                                                                                        • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                        • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
                                                                                                        • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                        • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
                                                                                                        • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                        • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                        • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$Enable$Show$MessageSend
                                                                                                        • String ID:
                                                                                                        • API String ID: 1871949834-0
                                                                                                        • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                        • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
                                                                                                        • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                        • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 0044961A
                                                                                                        • SendMessageW.USER32 ref: 0044964A
                                                                                                          • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                        • SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
                                                                                                        • _wcslen.LIBCMT ref: 004496BA
                                                                                                        • _wcslen.LIBCMT ref: 004496C7
                                                                                                        • SendMessageW.USER32(?,00001074,?,?), ref: 004496FD
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$_wcslen$_memset_wcspbrk
                                                                                                        • String ID:
                                                                                                        • API String ID: 1624073603-0
                                                                                                        • Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                        • Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
                                                                                                        • Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                        • Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                        • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
                                                                                                        • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                        • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
                                                                                                        APIs
                                                                                                        • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DestroyWindow$DeleteObject$IconMove
                                                                                                        • String ID:
                                                                                                        • API String ID: 1640429340-0
                                                                                                        • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                        • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
                                                                                                        • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                        • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __fileno__setmode$DebugOutputString_fprintf
                                                                                                        • String ID:
                                                                                                        • API String ID: 3354276064-0
                                                                                                        • Opcode ID: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                                        • Instruction ID: 1e9a75ed7ce68f0ee686932f25d41d1f14ae1a91d469003489e3a0780bce169f
                                                                                                        • Opcode Fuzzy Hash: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                                        • Instruction Fuzzy Hash: 6D11F3B2D0830136D500BA366C02AAF7A5C4A91B5CF44056EFD4563293EA2DAA4943FF
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Destroy$DeleteMenuObject$IconWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 752480666-0
                                                                                                        • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                        • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
                                                                                                        • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                        • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
                                                                                                        APIs
                                                                                                        • DestroyWindow.USER32(00000000), ref: 0045527A
                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 0045528C
                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                        • String ID:
                                                                                                        • API String ID: 3275902921-0
                                                                                                        • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                        • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
                                                                                                        • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                        • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
                                                                                                        APIs
                                                                                                        • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
                                                                                                        • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
                                                                                                        • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
                                                                                                        • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
                                                                                                        • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
                                                                                                        • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                        • String ID:
                                                                                                        • API String ID: 1413079979-0
                                                                                                        • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                        • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
                                                                                                        • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                        • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
                                                                                                        APIs
                                                                                                        • ___set_flsgetvalue.LIBCMT ref: 0041418F
                                                                                                        • __calloc_crt.LIBCMT ref: 0041419B
                                                                                                        • __getptd.LIBCMT ref: 004141A8
                                                                                                        • CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
                                                                                                        • __dosmaperr.LIBCMT ref: 00414201
                                                                                                          • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                          • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                        • String ID:
                                                                                                        • API String ID: 1803633139-0
                                                                                                        • Opcode ID: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                                        • Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
                                                                                                        • Opcode Fuzzy Hash: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                                        • Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68
                                                                                                        APIs
                                                                                                        • ImageList_Destroy.COMCTL32(?), ref: 004555E8
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                        • String ID:
                                                                                                        • API String ID: 3275902921-0
                                                                                                        • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                        • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
                                                                                                        • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                        • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32 ref: 004554DF
                                                                                                        • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DeleteDestroyMessageObjectSend$IconWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 3691411573-0
                                                                                                        • Opcode ID: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                        • Instruction ID: ead105b7aa3a144aa2df3f4c31681f961a0d6b706109639263d1a652a664e8ec
                                                                                                        • Opcode Fuzzy Hash: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                        • Instruction Fuzzy Hash: A5118F713046419BDB10DF68DD88A2A77A8FB58322F404A2AFE14DB2D1D775DC498B68
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcslen$_wcstok$ExtentPoint32Text
                                                                                                        • String ID:
                                                                                                        • API String ID: 1814673581-0
                                                                                                        • Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                        • Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
                                                                                                        • Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                        • Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA
                                                                                                        APIs
                                                                                                        • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
                                                                                                        • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
                                                                                                        • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
                                                                                                        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                        • String ID:
                                                                                                        • API String ID: 2833360925-0
                                                                                                        • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                        • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
                                                                                                        • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                        • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
                                                                                                        APIs
                                                                                                          • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                          • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                          • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                        • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
                                                                                                        • LineTo.GDI32(?,?,?), ref: 00447227
                                                                                                        • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
                                                                                                        • LineTo.GDI32(?,?,?), ref: 0044723D
                                                                                                        • EndPath.GDI32(?), ref: 0044724E
                                                                                                        • StrokePath.GDI32(?), ref: 0044725C
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                                                                                        • String ID:
                                                                                                        • API String ID: 372113273-0
                                                                                                        • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                        • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
                                                                                                        • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                        • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
                                                                                                        APIs
                                                                                                        • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
                                                                                                        • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
                                                                                                        • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
                                                                                                        • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
                                                                                                        • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
                                                                                                        • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Virtual
                                                                                                        • String ID:
                                                                                                        • API String ID: 4278518827-0
                                                                                                        • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                        • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
                                                                                                        • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                        • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
                                                                                                        APIs
                                                                                                        • GetDC.USER32(00000000), ref: 0044CBEF
                                                                                                        • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
                                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
                                                                                                        • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
                                                                                                        • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
                                                                                                        • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CapsDevice$Release
                                                                                                        • String ID:
                                                                                                        • API String ID: 1035833867-0
                                                                                                        • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                        • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
                                                                                                        • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                        • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
                                                                                                        APIs
                                                                                                        • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
                                                                                                        • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
                                                                                                        • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
                                                                                                        • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                                                                                                          • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
                                                                                                        • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
                                                                                                        • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                                        • String ID:
                                                                                                        • API String ID: 3495660284-0
                                                                                                        • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                        • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
                                                                                                        • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                        • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
                                                                                                        APIs
                                                                                                        • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
                                                                                                        • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
                                                                                                        • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
                                                                                                        • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
                                                                                                        • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00437174
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 839392675-0
                                                                                                        • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                        • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
                                                                                                        • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                        • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
                                                                                                        APIs
                                                                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\fAzUnj6Djg.exe,00000004), ref: 00436055
                                                                                                        • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
                                                                                                        • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
                                                                                                        • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
                                                                                                        • GetLastError.KERNEL32 ref: 00436081
                                                                                                        • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
                                                                                                        • String ID:
                                                                                                        • API String ID: 1690418490-0
                                                                                                        • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                        • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
                                                                                                        • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                        • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
                                                                                                        APIs
                                                                                                          • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                        • CoInitialize.OLE32(00000000), ref: 00475B71
                                                                                                        • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
                                                                                                        • CoUninitialize.OLE32 ref: 00475D71
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                        • String ID: .lnk$HH
                                                                                                        • API String ID: 886957087-3121654589
                                                                                                        • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                        • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
                                                                                                        • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                        • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Menu$Delete$InfoItem_memset
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 1173514356-4108050209
                                                                                                        • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                        • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
                                                                                                        • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                        • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
                                                                                                        APIs
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
                                                                                                        • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
                                                                                                        • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$_wcslen
                                                                                                        • String ID: ComboBox$ListBox
                                                                                                        • API String ID: 763830540-1403004172
                                                                                                        • Opcode ID: 7f2c4204b424c93c7ac22b89fbd31dfb367e10b18f94ca1fc21d6a87b04bc3c1
                                                                                                        • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
                                                                                                        • Opcode Fuzzy Hash: 7f2c4204b424c93c7ac22b89fbd31dfb367e10b18f94ca1fc21d6a87b04bc3c1
                                                                                                        • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
                                                                                                        APIs
                                                                                                        • GetStdHandle.KERNEL32(?), ref: 004439B4
                                                                                                          • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,74DF2EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                          • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                          • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CurrentHandleProcess$Duplicate
                                                                                                        • String ID: nul
                                                                                                        • API String ID: 2124370227-2873401336
                                                                                                        • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                        • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
                                                                                                        • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                        • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
                                                                                                        APIs
                                                                                                        • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                                                                                                          • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,74DF2EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                          • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                          • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CurrentHandleProcess$Duplicate
                                                                                                        • String ID: nul
                                                                                                        • API String ID: 2124370227-2873401336
                                                                                                        • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                        • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
                                                                                                        • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                        • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
                                                                                                        • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
                                                                                                        • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
                                                                                                        • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                                        • String ID: SysAnimate32
                                                                                                        • API String ID: 3529120543-1011021900
                                                                                                        • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                        • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
                                                                                                        • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                        • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
                                                                                                        APIs
                                                                                                        • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
                                                                                                        • TranslateMessage.USER32(?), ref: 0044308B
                                                                                                        • DispatchMessageW.USER32(?), ref: 00443096
                                                                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Message$Peek$DispatchTranslate
                                                                                                        • String ID: *.*
                                                                                                        • API String ID: 1795658109-438819550
                                                                                                        • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                        • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
                                                                                                        • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                        • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
                                                                                                        APIs
                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                          • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                          • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                          • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                          • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                        • GetFocus.USER32 ref: 004609EF
                                                                                                          • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                                                                                                          • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
                                                                                                        • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
                                                                                                        • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
                                                                                                        • __swprintf.LIBCMT ref: 00460A7A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_wcslen
                                                                                                        • String ID: %s%d
                                                                                                        • API String ID: 991886796-1110647743
                                                                                                        • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                        • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
                                                                                                        • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                        • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _memset$_sprintf
                                                                                                        • String ID: %02X
                                                                                                        • API String ID: 891462717-436463671
                                                                                                        • Opcode ID: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                        • Instruction ID: c3235ccac5cd273424cb9b73a8b9e0f10e05fa8943de770f4571b5c3e9b76774
                                                                                                        • Opcode Fuzzy Hash: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                        • Instruction Fuzzy Hash: 5B11E97225021167D314FA698C93BEE724CAB45704F50453FF541A75C1EF6CB558839E
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 0042CD00
                                                                                                        • GetOpenFileNameW.COMDLG32 ref: 0042CD51
                                                                                                          • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\fAzUnj6Djg.exe,?,C:\Users\user\Desktop\fAzUnj6Djg.exe,004A8E80,C:\Users\user\Desktop\fAzUnj6Djg.exe,0040F3D2), ref: 0040FFCA
                                                                                                          • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                                                                                          • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                                                                                          • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
                                                                                                          • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                                                                                          • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC
                                                                                                          • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
                                                                                                        • String ID: $OH$@OH$X
                                                                                                        • API String ID: 3491138722-1394974532
                                                                                                        • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                        • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
                                                                                                        • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                        • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
                                                                                                        APIs
                                                                                                        • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
                                                                                                        • GetProcAddress.KERNEL32(?,?), ref: 00463E68
                                                                                                        • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
                                                                                                        • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
                                                                                                        • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressProc$Library$FreeLoad
                                                                                                        • String ID:
                                                                                                        • API String ID: 2449869053-0
                                                                                                        • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                        • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
                                                                                                        • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                        • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
                                                                                                        APIs
                                                                                                        • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
                                                                                                        • SetKeyboardState.USER32(00000080), ref: 0044C3ED
                                                                                                        • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
                                                                                                        • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
                                                                                                        • SendInput.USER32 ref: 0044C509
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: KeyboardMessagePostState$InputSend
                                                                                                        • String ID:
                                                                                                        • API String ID: 3031425849-0
                                                                                                        • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                        • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
                                                                                                        • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                        • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
                                                                                                        APIs
                                                                                                        • RegEnumKeyExW.ADVAPI32 ref: 004422F0
                                                                                                        • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
                                                                                                        • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
                                                                                                        • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Enum$CloseDeleteOpen
                                                                                                        • String ID:
                                                                                                        • API String ID: 2095303065-0
                                                                                                        • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                        • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
                                                                                                        • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                        • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
                                                                                                        APIs
                                                                                                        • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
                                                                                                        • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
                                                                                                        • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
                                                                                                        • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
                                                                                                        • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: PrivateProfile$SectionWrite$String
                                                                                                        • String ID:
                                                                                                        • API String ID: 2832842796-0
                                                                                                        • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                        • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
                                                                                                        • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                        • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
                                                                                                        APIs
                                                                                                        • GetClientRect.USER32(?,?), ref: 00447997
                                                                                                        • GetCursorPos.USER32(?), ref: 004479A2
                                                                                                        • ScreenToClient.USER32(?,?), ref: 004479BE
                                                                                                        • WindowFromPoint.USER32(?,?), ref: 004479FF
                                                                                                        • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Client$CursorFromPointProcRectScreenWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 1822080540-0
                                                                                                        • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                        • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
                                                                                                        • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                        • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
                                                                                                        APIs
                                                                                                        • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                        • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                        • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                        • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                        • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ClientPaintRectRectangleScreenViewportWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 659298297-0
                                                                                                        • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                        • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
                                                                                                        • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                        • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
                                                                                                        APIs
                                                                                                        • GetCursorPos.USER32(?), ref: 004478A7
                                                                                                        • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
                                                                                                        • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
                                                                                                        • GetCursorPos.USER32(?), ref: 00447935
                                                                                                        • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CursorMenuPopupTrack$Proc
                                                                                                        • String ID:
                                                                                                        • API String ID: 1300944170-0
                                                                                                        • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                        • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
                                                                                                        • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                        • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
                                                                                                        APIs
                                                                                                        • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                        • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                        • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                        • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                          • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                          • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                          • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                          • Part of subcall function 004413F0: SendMessageW.USER32(001F1B20,000000F1,00000000,00000000), ref: 004414C6
                                                                                                          • Part of subcall function 004413F0: SendMessageW.USER32(001F1B20,000000F1,00000001,00000000), ref: 004414F1
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$EnableMessageSend$LongShow
                                                                                                        • String ID:
                                                                                                        • API String ID: 142311417-0
                                                                                                        • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                        • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
                                                                                                        • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                        • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 0044955A
                                                                                                          • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                        • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
                                                                                                        • _wcslen.LIBCMT ref: 004495C1
                                                                                                        • _wcslen.LIBCMT ref: 004495CE
                                                                                                        • SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend_wcslen$_memset_wcspbrk
                                                                                                        • String ID:
                                                                                                        • API String ID: 1843234404-0
                                                                                                        • Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                        • Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
                                                                                                        • Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                        • Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                        • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
                                                                                                        • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                        • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
                                                                                                        APIs
                                                                                                        • IsWindowVisible.USER32(?), ref: 00445721
                                                                                                        • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
                                                                                                        • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
                                                                                                        • _wcslen.LIBCMT ref: 004457A3
                                                                                                        • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
                                                                                                        • String ID:
                                                                                                        • API String ID: 3087257052-0
                                                                                                        • Opcode ID: 707967777abbcb615846d4014dd15678eb91240126a64b2d293a4799175c36b7
                                                                                                        • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
                                                                                                        • Opcode Fuzzy Hash: 707967777abbcb615846d4014dd15678eb91240126a64b2d293a4799175c36b7
                                                                                                        • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
                                                                                                        APIs
                                                                                                        • IsWindow.USER32(00000000), ref: 00459DEF
                                                                                                        • GetForegroundWindow.USER32 ref: 00459E07
                                                                                                        • GetDC.USER32(00000000), ref: 00459E44
                                                                                                        • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
                                                                                                        • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$ForegroundPixelRelease
                                                                                                        • String ID:
                                                                                                        • API String ID: 4156661090-0
                                                                                                        • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                        • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
                                                                                                        • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                        • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
                                                                                                        APIs
                                                                                                          • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                        • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 00464985
                                                                                                        • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
                                                                                                        • connect.WSOCK32(00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649CD
                                                                                                        • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
                                                                                                        • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 00464A07
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorLast$closesocketconnectinet_addrsocket
                                                                                                        • String ID:
                                                                                                        • API String ID: 245547762-0
                                                                                                        • Opcode ID: c11d93ef0e5925fc7b778e12926c76e847d2ba71e7f4531691fb5523561cfb0e
                                                                                                        • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
                                                                                                        • Opcode Fuzzy Hash: c11d93ef0e5925fc7b778e12926c76e847d2ba71e7f4531691fb5523561cfb0e
                                                                                                        • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
                                                                                                        APIs
                                                                                                        • DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                        • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                        • SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                        • BeginPath.GDI32(?), ref: 004471B7
                                                                                                        • SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Object$Select$BeginCreateDeletePath
                                                                                                        • String ID:
                                                                                                        • API String ID: 2338827641-0
                                                                                                        • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                        • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
                                                                                                        • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                        • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
                                                                                                        APIs
                                                                                                        • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
                                                                                                        • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
                                                                                                        • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
                                                                                                        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CounterPerformanceQuerySleep
                                                                                                        • String ID:
                                                                                                        • API String ID: 2875609808-0
                                                                                                        • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                        • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
                                                                                                        • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                        • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32 ref: 0046FD00
                                                                                                        • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
                                                                                                        • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
                                                                                                        • DestroyIcon.USER32(?), ref: 0046FD58
                                                                                                        • DestroyIcon.USER32(?), ref: 0046FD5F
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$DestroyIcon
                                                                                                        • String ID:
                                                                                                        • API String ID: 3419509030-0
                                                                                                        • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                        • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
                                                                                                        • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                        • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
                                                                                                        APIs
                                                                                                        • __getptd.LIBCMT ref: 004175AE
                                                                                                          • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                          • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                        • __amsg_exit.LIBCMT ref: 004175CE
                                                                                                        • __lock.LIBCMT ref: 004175DE
                                                                                                        • InterlockedDecrement.KERNEL32(?), ref: 004175FB
                                                                                                        • InterlockedIncrement.KERNEL32(001F2CE0), ref: 00417626
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                        • String ID:
                                                                                                        • API String ID: 4271482742-0
                                                                                                        • Opcode ID: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                                        • Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
                                                                                                        • Opcode Fuzzy Hash: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                                        • Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE
                                                                                                        APIs
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Destroy$DeleteObjectWindow$Icon
                                                                                                        • String ID:
                                                                                                        • API String ID: 4023252218-0
                                                                                                        • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                        • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
                                                                                                        • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                        • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
                                                                                                        APIs
                                                                                                        • GetDlgItem.USER32(?,000003E9), ref: 00460342
                                                                                                        • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
                                                                                                        • MessageBeep.USER32(00000000), ref: 0046036D
                                                                                                        • KillTimer.USER32(?,0000040A), ref: 00460392
                                                                                                        • EndDialog.USER32(?,00000001), ref: 004603AB
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 3741023627-0
                                                                                                        • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                        • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
                                                                                                        • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                        • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DeleteDestroyObject$IconMessageSendWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 1489400265-0
                                                                                                        • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                        • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
                                                                                                        • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                        • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
                                                                                                        APIs
                                                                                                          • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
                                                                                                        • String ID:
                                                                                                        • API String ID: 1042038666-0
                                                                                                        • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                        • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
                                                                                                        • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                        • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                        • String ID:
                                                                                                        • API String ID: 2625713937-0
                                                                                                        • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                        • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
                                                                                                        • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                        • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
                                                                                                        APIs
                                                                                                          • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                        • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                          • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                          • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                          • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                        • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                          • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                        • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                          • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                        • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                        • ExitThread.KERNEL32 ref: 0041410F
                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                        • __freefls@4.LIBCMT ref: 00414135
                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                        • String ID:
                                                                                                        • API String ID: 132634196-0
                                                                                                        • Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                        • Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
                                                                                                        • Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                        • Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD
                                                                                                        APIs
                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00415610
                                                                                                          • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                        • __getptd_noexit.LIBCMT ref: 00415620
                                                                                                        • CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
                                                                                                        • __freeptd.LIBCMT ref: 0041563B
                                                                                                        • ExitThread.KERNEL32 ref: 00415643
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                        • String ID:
                                                                                                        • API String ID: 3798957060-0
                                                                                                        • Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                        • Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
                                                                                                        • Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                        • Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD
                                                                                                        APIs
                                                                                                          • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                        • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                          • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                          • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                          • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                        • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                          • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                        • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                          • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                        • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                        • ExitThread.KERNEL32 ref: 004156BD
                                                                                                        • __freefls@4.LIBCMT ref: 004156D9
                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                        • String ID:
                                                                                                        • API String ID: 1537469427-0
                                                                                                        • Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                        • Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
                                                                                                        • Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                        • Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _malloc
                                                                                                        • String ID: Default$|k
                                                                                                        • API String ID: 1579825452-2254895183
                                                                                                        • Opcode ID: 3487a4ebd3b6326aef9d7885c20b94cf9b3333ebd549fd878091b2165ba8d13b
                                                                                                        • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
                                                                                                        • Opcode Fuzzy Hash: 3487a4ebd3b6326aef9d7885c20b94cf9b3333ebd549fd878091b2165ba8d13b
                                                                                                        • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _memcmp
                                                                                                        • String ID: '$[$h
                                                                                                        • API String ID: 2931989736-1224472061
                                                                                                        • Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                        • Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
                                                                                                        • Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                        • Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _strncmp
                                                                                                        • String ID: >$R$U
                                                                                                        • API String ID: 909875538-1924298640
                                                                                                        • Opcode ID: 83caccdc30ebaedd60eda3635d3ed4fa95617b34971efb7504fa10d53abc7e5a
                                                                                                        • Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
                                                                                                        • Opcode Fuzzy Hash: 83caccdc30ebaedd60eda3635d3ed4fa95617b34971efb7504fa10d53abc7e5a
                                                                                                        • Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56
                                                                                                        APIs
                                                                                                          • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                        • CoInitialize.OLE32(00000000), ref: 0046CE18
                                                                                                        • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
                                                                                                        • CoUninitialize.OLE32 ref: 0046CE50
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                        • String ID: .lnk
                                                                                                        • API String ID: 886957087-24824748
                                                                                                        • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                        • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
                                                                                                        • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                        • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
                                                                                                        Strings
                                                                                                        • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00469C37
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcslen
                                                                                                        • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                                                        • API String ID: 176396367-557222456
                                                                                                        • Opcode ID: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                        • Instruction ID: 5ec49088f7a0f5eff408c40ec761cfb1cab3d77d8e9f1d748350f88cc39ab646
                                                                                                        • Opcode Fuzzy Hash: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                        • Instruction Fuzzy Hash: 2C818F715183009FC310EF65C88186BB7E8AF85714F408A2FF5959B2A2E778ED45CB9B
                                                                                                        APIs
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                        • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
                                                                                                        • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
                                                                                                        • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Variant$ClearCopyInit_malloc
                                                                                                        • String ID: 4RH
                                                                                                        • API String ID: 2981388473-749298218
                                                                                                        • Opcode ID: 886d72268d4c4b31cd7e9b97dec5c8ab100e14167db6bca7b584ef53709687b2
                                                                                                        • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
                                                                                                        • Opcode Fuzzy Hash: 886d72268d4c4b31cd7e9b97dec5c8ab100e14167db6bca7b584ef53709687b2
                                                                                                        • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
                                                                                                        APIs
                                                                                                          • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                          • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                        • __wcsnicmp.LIBCMT ref: 0046681A
                                                                                                        • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Connection__wcsnicmp_wcscpy_wcslen
                                                                                                        • String ID: LPT$HH
                                                                                                        • API String ID: 3035604524-2728063697
                                                                                                        • Opcode ID: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                                                        • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
                                                                                                        • Opcode Fuzzy Hash: 2945cb5b31277d8c8021d55f3d7ec86f9f5d8a101f6134c00f702d091f19bef7
                                                                                                        • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
                                                                                                        APIs
                                                                                                          • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                                                        • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                                                                                                          • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                                                                                                        • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
                                                                                                        • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$MemoryProcess$ReadWrite
                                                                                                        • String ID: @
                                                                                                        • API String ID: 4055202900-2766056989
                                                                                                        • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                        • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
                                                                                                        • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                        • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CrackInternet_memset_wcslen
                                                                                                        • String ID: |
                                                                                                        • API String ID: 915713708-2343686810
                                                                                                        • Opcode ID: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                        • Instruction ID: 59fb16093b155e5aebf0565036b17e76eaaa1a90c891d08183ce313382d628e9
                                                                                                        • Opcode Fuzzy Hash: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                        • Instruction Fuzzy Hash: AE417EB2754301ABD204EF69DC81B9BF7E8FB88714F00052EF64593290DB75E909CBA6
                                                                                                        APIs
                                                                                                        • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
                                                                                                        • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
                                                                                                        • HttpQueryInfoW.WININET ref: 0044A892
                                                                                                          • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                                                                                        • String ID:
                                                                                                        • API String ID: 3705125965-3916222277
                                                                                                        • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                        • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
                                                                                                        • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                        • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
                                                                                                        APIs
                                                                                                        • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
                                                                                                        • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$Long
                                                                                                        • String ID: SysTreeView32
                                                                                                        • API String ID: 847901565-1698111956
                                                                                                        • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                        • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
                                                                                                        • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                        • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
                                                                                                        APIs
                                                                                                        • LoadLibraryA.KERNEL32(?), ref: 00437CB2
                                                                                                        • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
                                                                                                        • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Library$AddressFreeLoadProc
                                                                                                        • String ID: AU3_GetPluginDetails
                                                                                                        • API String ID: 145871493-4132174516
                                                                                                        • Opcode ID: 86e4c61e32d2ed878dfd7fe720ec64e92d9a8cb9aafa3c38a6749b64446316ec
                                                                                                        • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
                                                                                                        • Opcode Fuzzy Hash: 86e4c61e32d2ed878dfd7fe720ec64e92d9a8cb9aafa3c38a6749b64446316ec
                                                                                                        • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
                                                                                                        APIs
                                                                                                        • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DestroyWindow
                                                                                                        • String ID: msctls_updown32
                                                                                                        • API String ID: 3375834691-2298589950
                                                                                                        • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                        • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
                                                                                                        • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                        • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
                                                                                                        • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
                                                                                                        • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$MoveWindow
                                                                                                        • String ID: Listbox
                                                                                                        • API String ID: 3315199576-2633736733
                                                                                                        • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                        • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
                                                                                                        • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                        • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
                                                                                                        APIs
                                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D243
                                                                                                        • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
                                                                                                        • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorMode$InformationVolume
                                                                                                        • String ID: HH
                                                                                                        • API String ID: 2507767853-2761332787
                                                                                                        • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                        • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
                                                                                                        • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                        • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
                                                                                                        APIs
                                                                                                        • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
                                                                                                        • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
                                                                                                        • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorMode$InformationVolume
                                                                                                        • String ID: HH
                                                                                                        • API String ID: 2507767853-2761332787
                                                                                                        • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                        • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
                                                                                                        • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                        • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
                                                                                                        • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
                                                                                                        • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend
                                                                                                        • String ID: msctls_trackbar32
                                                                                                        • API String ID: 3850602802-1010561917
                                                                                                        • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                        • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
                                                                                                        • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                        • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
                                                                                                        APIs
                                                                                                          • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                        • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046BD78
                                                                                                        • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
                                                                                                        • inet_ntoa.WSOCK32(00000000,?), ref: 0046BDCD
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
                                                                                                        • String ID: HH
                                                                                                        • API String ID: 1515696956-2761332787
                                                                                                        • Opcode ID: 536d88bcd2219f00ee4950b39be395ae06382d48515621a82e1548501abb3963
                                                                                                        • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
                                                                                                        • Opcode Fuzzy Hash: 536d88bcd2219f00ee4950b39be395ae06382d48515621a82e1548501abb3963
                                                                                                        • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
                                                                                                        APIs
                                                                                                          • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                        • CoInitialize.OLE32(00000000), ref: 0046CE18
                                                                                                        • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
                                                                                                        • CoUninitialize.OLE32 ref: 0046CE50
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                        • String ID: .lnk
                                                                                                        • API String ID: 886957087-24824748
                                                                                                        • Opcode ID: 8095c6d59d69238af541582e7c79e2891b33013a97e816c4c493b562f1f8ea66
                                                                                                        • Instruction ID: 634f95a1702cd93f148e07eb64efb4b351689d97c5b229aafe37579347e0b37e
                                                                                                        • Opcode Fuzzy Hash: 8095c6d59d69238af541582e7c79e2891b33013a97e816c4c493b562f1f8ea66
                                                                                                        • Instruction Fuzzy Hash: E821AF312083009FC700EF55C985F5ABBF4EF89724F148A6EF9549B2E2D7B5A805CB56
                                                                                                        APIs
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                        • GetMenuItemInfoW.USER32 ref: 004497EA
                                                                                                        • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
                                                                                                        • DrawMenuBar.USER32 ref: 00449828
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Menu$InfoItem$Draw_malloc
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 772068139-4108050209
                                                                                                        • Opcode ID: aba2b2f37e8aede0e07af882035f7c7ba327ed0a8d43e4983355c33413849c0f
                                                                                                        • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
                                                                                                        • Opcode Fuzzy Hash: aba2b2f37e8aede0e07af882035f7c7ba327ed0a8d43e4983355c33413849c0f
                                                                                                        • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AllocTask_wcslen
                                                                                                        • String ID: hkG
                                                                                                        • API String ID: 2651040394-3610518997
                                                                                                        • Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                        • Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
                                                                                                        • Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                        • Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5
                                                                                                        APIs
                                                                                                        • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
                                                                                                        • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                        • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                                        • API String ID: 2574300362-1816364905
                                                                                                        • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                        • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
                                                                                                        • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                        • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
                                                                                                        APIs
                                                                                                        • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
                                                                                                        • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                        • String ID: ICMP.DLL$IcmpSendEcho
                                                                                                        • API String ID: 2574300362-58917771
                                                                                                        • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                        • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
                                                                                                        • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                        • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
                                                                                                        APIs
                                                                                                        • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
                                                                                                        • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                        • String ID: ICMP.DLL$IcmpCloseHandle
                                                                                                        • API String ID: 2574300362-3530519716
                                                                                                        • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                        • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
                                                                                                        • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                        • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
                                                                                                        APIs
                                                                                                        • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
                                                                                                        • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                        • String ID: ICMP.DLL$IcmpCreateFile
                                                                                                        • API String ID: 2574300362-275556492
                                                                                                        • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                        • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
                                                                                                        • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                        • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
                                                                                                        APIs
                                                                                                        • LoadLibraryA.KERNEL32(kernel32.dll,0040E551,?), ref: 0040EE7B
                                                                                                        • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040EE8D
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressLibraryLoadProc
                                                                                                        • String ID: IsWow64Process$kernel32.dll
                                                                                                        • API String ID: 2574300362-3024904723
                                                                                                        • Opcode ID: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                                        • Instruction ID: 75875fa2f3f8b89ed4c8cde0d061cde3839b728dd3838c322d7dfd2ddbff31fa
                                                                                                        • Opcode Fuzzy Hash: 16a412f97595c511ed2c9e877c1bae7dd0f808d0cf5b3a9fdd28adcf59ee176d
                                                                                                        • Instruction Fuzzy Hash: 51D0C9B0940707DAC7301F72C91871B7AE4AB40342F204C3EB995A1290DBBCC0408B28
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ClearVariant
                                                                                                        • String ID:
                                                                                                        • API String ID: 1473721057-0
                                                                                                        • Opcode ID: c8a8680659340ce3ae7b61d15611f915275d61821cdaab737acf418eefb31e18
                                                                                                        • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
                                                                                                        • Opcode Fuzzy Hash: c8a8680659340ce3ae7b61d15611f915275d61821cdaab737acf418eefb31e18
                                                                                                        • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
                                                                                                        APIs
                                                                                                        • __flush.LIBCMT ref: 00414630
                                                                                                        • __fileno.LIBCMT ref: 00414650
                                                                                                        • __locking.LIBCMT ref: 00414657
                                                                                                        • __flsbuf.LIBCMT ref: 00414682
                                                                                                          • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                          • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                                                        • String ID:
                                                                                                        • API String ID: 3240763771-0
                                                                                                        • Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                        • Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
                                                                                                        • Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                        • Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48
                                                                                                        APIs
                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                        • VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                        • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                        • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CopyVariant$ErrorLast
                                                                                                        • String ID:
                                                                                                        • API String ID: 2286883814-0
                                                                                                        • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                        • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
                                                                                                        • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                        • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
                                                                                                        APIs
                                                                                                        • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
                                                                                                        • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
                                                                                                        • #21.WSOCK32 ref: 004740E0
                                                                                                        • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorLast$socket
                                                                                                        • String ID:
                                                                                                        • API String ID: 1881357543-0
                                                                                                        • Opcode ID: 34147ac461a0e284a181aa69957adffe558344c6371ca04fba36d93f3b76d486
                                                                                                        • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
                                                                                                        • Opcode Fuzzy Hash: 34147ac461a0e284a181aa69957adffe558344c6371ca04fba36d93f3b76d486
                                                                                                        • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
                                                                                                        APIs
                                                                                                        • ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                        • GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                        • PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                        • MessageBeep.USER32(00000000), ref: 00441DF2
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 1352109105-0
                                                                                                        • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                        • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
                                                                                                        • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                        • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
                                                                                                        APIs
                                                                                                        • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042387E
                                                                                                        • __isleadbyte_l.LIBCMT ref: 004238B2
                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000009,00000002,?,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 004238E3
                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000009,00000002,00000001,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 00423951
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                        • String ID:
                                                                                                        • API String ID: 3058430110-0
                                                                                                        • Opcode ID: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                        • Instruction ID: 550681b3841f0f34ee613cb5364b25607849a03987ccfca5eaaec14299199b49
                                                                                                        • Opcode Fuzzy Hash: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                        • Instruction Fuzzy Hash: A931C270B00265EFDB20EF64D8849AA7BF5EF01312B9445AAF0A09F291D338CE81CB55
                                                                                                        APIs
                                                                                                        • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
                                                                                                        • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
                                                                                                        • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
                                                                                                        • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                        • String ID:
                                                                                                        • API String ID: 3321077145-0
                                                                                                        • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                        • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
                                                                                                        • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                        • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
                                                                                                        APIs
                                                                                                        • GetParent.USER32(?), ref: 004505BF
                                                                                                        • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
                                                                                                        • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
                                                                                                        • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Proc$Parent
                                                                                                        • String ID:
                                                                                                        • API String ID: 2351499541-0
                                                                                                        • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                        • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
                                                                                                        • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                        • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
                                                                                                        APIs
                                                                                                          • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
                                                                                                          • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                        • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
                                                                                                        • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
                                                                                                        • __itow.LIBCMT ref: 00461461
                                                                                                        • __itow.LIBCMT ref: 004614AB
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$__itow$_wcslen
                                                                                                        • String ID:
                                                                                                        • API String ID: 2875217250-0
                                                                                                        • Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                        • Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
                                                                                                        • Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                        • Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB
                                                                                                        APIs
                                                                                                        • _memset.LIBCMT ref: 0040E202
                                                                                                        • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: IconNotifyShell__memset
                                                                                                        • String ID:
                                                                                                        • API String ID: 928536360-0
                                                                                                        • Opcode ID: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                                        • Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
                                                                                                        • Opcode Fuzzy Hash: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                                        • Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A
                                                                                                        APIs
                                                                                                        • GetForegroundWindow.USER32 ref: 00472806
                                                                                                          • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                                                                                                          • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                                                                                                          • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
                                                                                                        • GetCaretPos.USER32(?), ref: 0047281A
                                                                                                        • ClientToScreen.USER32(00000000,?), ref: 00472856
                                                                                                        • GetForegroundWindow.USER32 ref: 0047285C
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                        • String ID:
                                                                                                        • API String ID: 2759813231-0
                                                                                                        • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                        • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
                                                                                                        • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                        • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
                                                                                                        APIs
                                                                                                          • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                        • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
                                                                                                        • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
                                                                                                        • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
                                                                                                        • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$Long$AttributesLayered
                                                                                                        • String ID:
                                                                                                        • API String ID: 2169480361-0
                                                                                                        • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                        • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
                                                                                                        • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                        • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32 ref: 00448CB8
                                                                                                        • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
                                                                                                        • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
                                                                                                        • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend$LongWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 312131281-0
                                                                                                        • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                        • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
                                                                                                        • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                        • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
                                                                                                        APIs
                                                                                                        • select.WSOCK32 ref: 0045890A
                                                                                                        • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
                                                                                                        • accept.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 00458927
                                                                                                        • WSAGetLastError.WSOCK32(00000000), ref: 00458952
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorLastacceptselect
                                                                                                        • String ID:
                                                                                                        • API String ID: 385091864-0
                                                                                                        • Opcode ID: 4f99be09ea3748399bcd45f1fb284b1e509608db9923cba0f0141099163bafeb
                                                                                                        • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
                                                                                                        • Opcode Fuzzy Hash: 4f99be09ea3748399bcd45f1fb284b1e509608db9923cba0f0141099163bafeb
                                                                                                        • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
                                                                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
                                                                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
                                                                                                        • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend
                                                                                                        • String ID:
                                                                                                        • API String ID: 3850602802-0
                                                                                                        • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                        • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
                                                                                                        • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                        • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
                                                                                                        APIs
                                                                                                        • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
                                                                                                        • GetStockObject.GDI32(00000011), ref: 00433695
                                                                                                        • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
                                                                                                        • ShowWindow.USER32(00000000,00000000), ref: 004336BA
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Window$CreateMessageObjectSendShowStock
                                                                                                        • String ID:
                                                                                                        • API String ID: 1358664141-0
                                                                                                        • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                        • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
                                                                                                        • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                        • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
                                                                                                        APIs
                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 004441B8
                                                                                                        • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
                                                                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 00444213
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                                        • String ID:
                                                                                                        • API String ID: 2880819207-0
                                                                                                        • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                        • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
                                                                                                        • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                        • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
                                                                                                        APIs
                                                                                                        • GetWindowRect.USER32(?,?), ref: 00434037
                                                                                                        • ScreenToClient.USER32(?,?), ref: 0043405B
                                                                                                        • ScreenToClient.USER32(?,?), ref: 00434085
                                                                                                        • InvalidateRect.USER32(?,?,?), ref: 004340A4
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ClientRectScreen$InvalidateWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 357397906-0
                                                                                                        • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                        • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
                                                                                                        • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                        • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
                                                                                                        APIs
                                                                                                        • __wsplitpath.LIBCMT ref: 00436A45
                                                                                                          • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                        • __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                        • __wcsicoll.LIBCMT ref: 00436A93
                                                                                                        • __wcsicoll.LIBCMT ref: 00436AB0
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
                                                                                                        • String ID:
                                                                                                        • API String ID: 1187119602-0
                                                                                                        • Opcode ID: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                        • Instruction ID: cc447ddabc085245cf6c6bda96777749177fc915bba42f20b5b260b799017f3a
                                                                                                        • Opcode Fuzzy Hash: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                        • Instruction Fuzzy Hash: 690165B64043416BD724EB50D881EEBB3ED7BD8304F04C91EB5C982041FB38D24C87A6
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcslen$_malloc_wcscat_wcscpy
                                                                                                        • String ID:
                                                                                                        • API String ID: 1597257046-0
                                                                                                        • Opcode ID: ef4c8eb1668fb764ac9879486c39433899b48e1b70f0ed706df85b8b39ec7f0c
                                                                                                        • Instruction ID: 9df5ee2dcc5f1a759a9cde70f7b42babd8a8bdcc369222b22224423102f690bd
                                                                                                        • Opcode Fuzzy Hash: ef4c8eb1668fb764ac9879486c39433899b48e1b70f0ed706df85b8b39ec7f0c
                                                                                                        • Instruction Fuzzy Hash: BFF06D32200200AFC314EB66C885E6BB3EAEBC5324F04852EF556C7791DB39F841C764
                                                                                                        APIs
                                                                                                        • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                        • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                        • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                        • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DeleteDestroyObject$IconWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 3349847261-0
                                                                                                        • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                        • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
                                                                                                        • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                        • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
                                                                                                        APIs
                                                                                                        • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
                                                                                                        • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                                        • String ID:
                                                                                                        • API String ID: 2223660684-0
                                                                                                        • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                        • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
                                                                                                        • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                        • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
                                                                                                        APIs
                                                                                                          • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                          • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                          • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                          • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                        • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
                                                                                                        • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
                                                                                                        • EndPath.GDI32(?), ref: 004472B0
                                                                                                        • StrokePath.GDI32(?), ref: 004472BE
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                                                                                        • String ID:
                                                                                                        • API String ID: 2783949968-0
                                                                                                        • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                        • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
                                                                                                        • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                        • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
                                                                                                        APIs
                                                                                                        • __getptd.LIBCMT ref: 00417D1A
                                                                                                          • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                          • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                        • __getptd.LIBCMT ref: 00417D31
                                                                                                        • __amsg_exit.LIBCMT ref: 00417D3F
                                                                                                        • __lock.LIBCMT ref: 00417D4F
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                        • String ID:
                                                                                                        • API String ID: 3521780317-0
                                                                                                        • Opcode ID: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                        • Instruction ID: 784cd6646040312d8c3929352b57c791f513dbd9ce30c249d09a92555f0e5bc7
                                                                                                        • Opcode Fuzzy Hash: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                        • Instruction Fuzzy Hash: D4F06D319447089AD720FB66E4067EA32B0AF01728F11856FA4415B7D2DB3C99C08B9E
                                                                                                        APIs
                                                                                                        • GetDesktopWindow.USER32 ref: 00471144
                                                                                                        • GetDC.USER32(00000000), ref: 0047114D
                                                                                                        • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
                                                                                                        • ReleaseDC.USER32(00000000,?), ref: 0047117B
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 2889604237-0
                                                                                                        • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                        • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
                                                                                                        • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                        • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
                                                                                                        APIs
                                                                                                        • GetDesktopWindow.USER32 ref: 00471102
                                                                                                        • GetDC.USER32(00000000), ref: 0047110B
                                                                                                        • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
                                                                                                        • ReleaseDC.USER32(00000000,?), ref: 00471139
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 2889604237-0
                                                                                                        • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                        • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
                                                                                                        • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                        • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
                                                                                                        APIs
                                                                                                        • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                        • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                        • AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                                        • String ID:
                                                                                                        • API String ID: 2710830443-0
                                                                                                        • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                        • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
                                                                                                        • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                        • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
                                                                                                        APIs
                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
                                                                                                        • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
                                                                                                        • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
                                                                                                        • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
                                                                                                          • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
                                                                                                          • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                        • String ID:
                                                                                                        • API String ID: 146765662-0
                                                                                                        • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                        • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
                                                                                                        • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                        • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
                                                                                                        APIs
                                                                                                        • __IsNonwritableInCurrentImage.LIBCMT ref: 00414070
                                                                                                          • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                        • __getptd_noexit.LIBCMT ref: 00414080
                                                                                                        • __freeptd.LIBCMT ref: 0041408A
                                                                                                        • ExitThread.KERNEL32 ref: 00414093
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                        • String ID:
                                                                                                        • API String ID: 3182216644-0
                                                                                                        • Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                        • Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
                                                                                                        • Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                        • Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: BuffCharLower
                                                                                                        • String ID: $8'I
                                                                                                        • API String ID: 2358735015-3608026889
                                                                                                        • Opcode ID: e3039598ad07eb1683e22d1e13845cc1c6bfaba1fe80df618d976ecbdfba683b
                                                                                                        • Instruction ID: 1bf34105e022c250dd7240f1ea7ec4803edb57b208c13e69c3fb06210d7c4844
                                                                                                        • Opcode Fuzzy Hash: e3039598ad07eb1683e22d1e13845cc1c6bfaba1fe80df618d976ecbdfba683b
                                                                                                        • Instruction Fuzzy Hash: 9FE1AE745043018BCB24EF16D88166BB7E4BF94348F40482FF88597292EB79DD89CB9B
                                                                                                        APIs
                                                                                                        • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                          • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                                                                                                          • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                          • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CopyVariant$ContainedObject$ErrorLast_malloc
                                                                                                        • String ID: AutoIt3GUI$Container
                                                                                                        • API String ID: 3380330463-3941886329
                                                                                                        • Opcode ID: a9ff7069b9b8d6ccd49eba872ad7efd2467de888f1098c4430e935d21ee713db
                                                                                                        • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
                                                                                                        • Opcode Fuzzy Hash: a9ff7069b9b8d6ccd49eba872ad7efd2467de888f1098c4430e935d21ee713db
                                                                                                        • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
                                                                                                        APIs
                                                                                                        • _wcslen.LIBCMT ref: 00409A61
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                          • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                          • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                          • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                        • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                        • String ID: 0vH
                                                                                                        • API String ID: 1143807570-3662162768
                                                                                                        • Opcode ID: 06636c051a656e0db8e48e9a81f0f7daa77b956eb8708b24b717754a54bb628e
                                                                                                        • Instruction ID: 5e67718e4417cbef977f4cc7974cb0b4b39b480e5382bb1977b3cac956c07efc
                                                                                                        • Opcode Fuzzy Hash: 06636c051a656e0db8e48e9a81f0f7daa77b956eb8708b24b717754a54bb628e
                                                                                                        • Instruction Fuzzy Hash: 53515BB1A083009FC718CF18C48065BB7E1FF88314F54856EF9999B391D779E942CB96
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: HH$HH
                                                                                                        • API String ID: 0-1787419579
                                                                                                        • Opcode ID: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                                                        • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
                                                                                                        • Opcode Fuzzy Hash: 7546cf6663fec2d41e0be28018c51c43d88dc93244b488606bcda1ed75612bc1
                                                                                                        • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: InfoItemMenu_memset
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 2223754486-4108050209
                                                                                                        • Opcode ID: 38f09aa922346eb88559bb972c0ed36bedb4057ad35cf6b519ccfeef0a85981d
                                                                                                        • Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
                                                                                                        • Opcode Fuzzy Hash: 38f09aa922346eb88559bb972c0ed36bedb4057ad35cf6b519ccfeef0a85981d
                                                                                                        • Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
                                                                                                        • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend
                                                                                                        • String ID: '
                                                                                                        • API String ID: 3850602802-1997036262
                                                                                                        • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                        • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
                                                                                                        • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                        • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 0-4108050209
                                                                                                        • Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                        • Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
                                                                                                        • Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                        • Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
                                                                                                        • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend
                                                                                                        • String ID: Combobox
                                                                                                        • API String ID: 3850602802-2096851135
                                                                                                        • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                        • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
                                                                                                        • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                        • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
                                                                                                        APIs
                                                                                                        • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
                                                                                                        • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: LengthMessageSendTextWindow
                                                                                                        • String ID: edit
                                                                                                        • API String ID: 2978978980-2167791130
                                                                                                        • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                        • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
                                                                                                        • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                        • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
                                                                                                        APIs
                                                                                                        • Sleep.KERNEL32(00000000), ref: 00474833
                                                                                                        • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: GlobalMemorySleepStatus
                                                                                                        • String ID: @
                                                                                                        • API String ID: 2783356886-2766056989
                                                                                                        • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                        • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
                                                                                                        • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                        • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: htonsinet_addr
                                                                                                        • String ID: 255.255.255.255
                                                                                                        • API String ID: 3832099526-2422070025
                                                                                                        • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                        • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
                                                                                                        • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                        • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
                                                                                                        APIs
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend_wcslen
                                                                                                        • String ID: ComboBox$ListBox
                                                                                                        • API String ID: 455545452-1403004172
                                                                                                        • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                        • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
                                                                                                        • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                        • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
                                                                                                        APIs
                                                                                                        • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: InternetOpen
                                                                                                        • String ID: <local>
                                                                                                        • API String ID: 2038078732-4266983199
                                                                                                        • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                        • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
                                                                                                        • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                        • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
                                                                                                        APIs
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend_wcslen
                                                                                                        • String ID: ComboBox$ListBox
                                                                                                        • API String ID: 455545452-1403004172
                                                                                                        • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                        • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
                                                                                                        • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                        • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
                                                                                                        APIs
                                                                                                          • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                        • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend_wcslen
                                                                                                        • String ID: ComboBox$ListBox
                                                                                                        • API String ID: 455545452-1403004172
                                                                                                        • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                        • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
                                                                                                        • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                        • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
                                                                                                        APIs
                                                                                                        • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                                                                                                          • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                        • wsprintfW.USER32 ref: 004560E9
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MessageSend_mallocwsprintf
                                                                                                        • String ID: %d/%02d/%02d
                                                                                                        • API String ID: 1262938277-328681919
                                                                                                        • Opcode ID: dc5fd9a877cd0fc352ed6de9b5f97ee6fb2dcbb154e3a48ad4a1e49fbb654ae8
                                                                                                        • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
                                                                                                        • Opcode Fuzzy Hash: dc5fd9a877cd0fc352ed6de9b5f97ee6fb2dcbb154e3a48ad4a1e49fbb654ae8
                                                                                                        • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
                                                                                                        APIs
                                                                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
                                                                                                        • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                                                                                                          • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: FindMessagePostSleepWindow
                                                                                                        • String ID: Shell_TrayWnd
                                                                                                        • API String ID: 529655941-2988720461
                                                                                                        • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                        • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
                                                                                                        • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                        • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
                                                                                                        APIs
                                                                                                        • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
                                                                                                        • PostMessageW.USER32(00000000), ref: 00442247
                                                                                                          • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: FindMessagePostSleepWindow
                                                                                                        • String ID: Shell_TrayWnd
                                                                                                        • API String ID: 529655941-2988720461
                                                                                                        • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                        • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
                                                                                                        • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                        • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
                                                                                                        APIs
                                                                                                        • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                                                                                                          • Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.1711293591.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.1711277119.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711339873.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711362015.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.1711393828.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_400000_fAzUnj6Djg.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Message_doexit
                                                                                                        • String ID: AutoIt$Error allocating memory.
                                                                                                        • API String ID: 1993061046-4017498283
                                                                                                        • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                        • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
                                                                                                        • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                        • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E